{"id":"CVE-2026-105481","aliases":["ALPINE-CVE-2026-105481","ALSA-2026:92376","ALSA-2026:92378","AZL-111056","BELL-CVE-2026-105481","BIT-node-2026-105481","BIT-node-min-2026-105481","CLSA-2026-1792746902","CLSA-2026-1792760716","DEBIAN-CVE-2026-105481","EUVD-2026-109106","GHSA-7h83-3rfm-3p3v","RLSA-2026:92376","RLSA-2026:92378","SUSE-SU-2026:24600-1","SUSE-SU-2026:4957-1","SUSE-SU-2026:5036-1","SUSE-SU-2026:5037-1","UBUNTU-CVE-2026-105481","openSUSE-SU-2026:12248-1","openSUSE-SU-2026:22210-1"],"status":"published","title":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response...","description":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.\n\nThe guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00318,"percentile":0.25026,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-367"],"published":"2026-10-23T00:00:00Z","modified":"2026-11-10T17:29:46Z","exploits":[{"source":"pocgithub","id":"CompleteTech-Security/node-cve-2026-105481-check","title":"CompleteTech-Security/node-cve-2026-105481-check","date":"2026-10-23","url":"https://github.com/CompleteTech-Security/node-cve-2026-105481-check"}],"fixes":[{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["22.23.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["22.23.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["26.12.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["24.22.1-0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nodejs22","fixed_in":["22.23.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nodejs24","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nodejs26","fixed_in":["26.12.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs22","fixed_in":["22.23.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs24","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs26","fixed_in":["26.12.1-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nodejs22","fixed_in":["22.23.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nodejs24","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nodejs26","fixed_in":["26.12.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs22","fixed_in":["22.23.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs24","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs26","fixed_in":["26.12.1-r1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["22.23.4","24.22.1","26.12.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["22.23.4","24.22.1","26.12.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["24.22.1+dfsg+~cs24.19.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.12.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el8.10.0+4250+09238ed4"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-3.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.23.2-r1"},{"fixed":"22.23.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.18.1-r0"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.0-r0"},{"fixed":"26.12.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.23.2-r0"},{"fixed":"22.23.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.18.1-r3"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.0-r0"},{"fixed":"26.12.1-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.23.2-r1"},{"fixed":"22.23.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.18.1-r0"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.0-r0"},{"fixed":"26.12.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.23.2-r0"},{"fixed":"22.23.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.18.1-r3"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.0-r0"},{"fixed":"26.12.1-r1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"22.23.4"},{"introduced":"23.0.0"},{"fixed":"24.22.1"},{"introduced":"25.0.0"},{"fixed":"26.12.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"22.23.4"},{"introduced":"23.0.0"},{"fixed":"24.22.1"},{"introduced":"25.0.0"},{"fixed":"26.12.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1","18.13.0+dfsg1-1.1","18.19.0+dfsg-1","18.19.0+dfsg-2","18.19.0+dfsg-3","18.19.0+dfsg-4","18.19.0+dfsg-5","18.19.0+dfsg-6","18.19.0+dfsg-6~deb12u1","18.19.0+dfsg-6~deb12u2","18.19.1+dfsg-1","18.19.1+dfsg-2","18.19.1+dfsg-3","18.19.1+dfsg-3.1","18.19.1+dfsg-4","18.19.1+dfsg-6","18.20.1+dfsg-1","18.20.1+dfsg-2","18.20.1+dfsg-3","18.20.1+dfsg-4","18.20.4+dfsg-1~deb12u1","18.20.4+dfsg-1~deb12u2","18.20.4+dfsg-1~deb12u3","20.10.0+dfsg-1","20.12.2+dfsg-1","20.13.0+dfsg-1","20.13.1+dfsg-1","20.13.1+dfsg-2","20.14.0+dfsg-1","20.14.0+dfsg-2","20.14.0+dfsg-3","20.15.0+dfsg-1","20.15.1+dfsg-1","20.16.0+dfsg-1","20.17.0+dfsg-1","20.17.0+dfsg-2","20.18.0+dfsg-1","20.18.0+dfsg-2","20.18.1+dfsg-1","20.18.1+dfsg-2","20.18.2+dfsg-1","20.18.2+dfsg-2","20.18.2+dfsg-3","20.18.2+dfsg-4","20.18.3+dfsg-1","20.19.0+dfsg-1","20.19.0+dfsg-2","20.19.0+dfsg1-1","20.19.2+dfsg-1","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1","24.19.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-2","24.21.0+dfsg+~cs24.13.4-1","24.22.0+dfsg+~cs24.19.2-1","24.22.0+dfsg+~cs24.19.2-2","24.22.1+dfsg+~cs24.19.2-1","24.22.2+dfsg+~cs24.19.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.19.2+dfsg-1","20.19.2+dfsg-1+deb13u1","20.19.2+dfsg-1+deb13u2","20.19.2+dfsg-1+deb13u3","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1","24.19.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-2","24.21.0+dfsg+~cs24.13.4-1","24.22.0+dfsg+~cs24.19.2-1","24.22.0+dfsg+~cs24.19.2-2","24.22.1+dfsg+~cs24.19.2-1","24.22.2+dfsg+~cs24.19.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1+dfsg+~cs24.19.2-1"}]}],"versions":["20.19.2+dfsg-1","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1","24.19.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-2","24.21.0+dfsg+~cs24.13.4-1","24.22.0+dfsg+~cs24.19.2-1","24.22.0+dfsg+~cs24.19.2-2"]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40278+50b003a3"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module+el9.8.0+40401+e24b8c95"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+40281+14cc6568"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-150600.13.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-150600.13.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-150700.3.21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-150700.15.21.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.15~dfsg1-4","0.10.21~dfsg1-1","0.10.22~dfsg1-2","0.10.23~dfsg1-1","0.10.23~dfsg1-2","0.10.23~dfsg1-3","0.10.24~dfsg1-1","0.10.25~dfsg2-2","0.10.25~dfsg2-2ubuntu1","0.10.25~dfsg2-2ubuntu1.2","0.10.25~dfsg2-2ubuntu1.2+esm1","0.10.25~dfsg2-2ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3","8.10.0~dfsg-2ubuntu0.4+esm4","8.10.0~dfsg-2ubuntu0.4+esm5","8.10.0~dfsg-2ubuntu0.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.15.2~dfsg-2ubuntu1","10.17.0~dfsg-2ubuntu4","10.17.0~dfsg-2ubuntu6","10.19.0~dfsg-3ubuntu1","10.19.0~dfsg-3ubuntu1.1","10.19.0~dfsg-3ubuntu1.2","10.19.0~dfsg-3ubuntu1.3","10.19.0~dfsg-3ubuntu1.5","10.19.0~dfsg-3ubuntu1.6","10.19.0~dfsg-3ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1ubuntu2","18.19.1+dfsg-2ubuntu4","18.19.1+dfsg-6ubuntu1","18.19.1+dfsg-6ubuntu2","18.19.1+dfsg-6ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.22.1+dfsg+~cs22.19.15-1ubuntu1","24.16.0+dfsg+~cs24.13.1-2ubuntu1","24.18.0+dfsg+~cs24.13.2-1ubuntu1","24.19.0+dfsg+~cs24.13.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-4","22.21.1+dfsg+~cs22.19.0-6ubuntu4","22.22.0+dfsg+~cs22.19.6-1ubuntu2","22.22.0+dfsg+~cs22.19.13-2ubuntu1","22.22.1+dfsg+~cs22.19.15-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-160000.1.1"}]}],"bundled":7}],"products":[{"vendor":"nodejs","product":"node"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105481","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-7h83-3rfm-3p3v"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-105481","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92376","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102276","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102277","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102278","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105481","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105482","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105483","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106069","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106071","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106072","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106073","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106074","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111497","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542596","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542706","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542707","tags":["report"]},{"url":"https://bugzilla.redhat.com/2558973","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559875","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560016","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560019","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560021","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560022","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-92376.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92378","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-92378.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-105481","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792746902.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105482","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106069","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792760716.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-105481","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92376","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560022","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92378","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624600-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286261","tags":["report"]},{"url":"https://bugzilla.suse.com/1286561","tags":["report"]},{"url":"https://bugzilla.suse.com/1286563","tags":["report"]},{"url":"https://bugzilla.suse.com/1286564","tags":["report"]},{"url":"https://bugzilla.suse.com/1286565","tags":["report"]},{"url":"https://bugzilla.suse.com/1286566","tags":["report"]},{"url":"https://bugzilla.suse.com/1286567","tags":["report"]},{"url":"https://bugzilla.suse.com/1286570","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111497","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264957-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265036-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265037-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262274","tags":["report"]},{"url":"https://bugzilla.suse.com/1266318","tags":["report"]},{"url":"https://bugzilla.suse.com/1276224","tags":["report"]},{"url":"https://bugzilla.suse.com/1286562","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105483","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-105481","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105481","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#keep-alive-socket-process-a-response-that-was-written-before-the-request-was-sent-cve-2026-105481---medium","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-105481","description":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.\n\nThe guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","status":"published","published":"2026-10-23T16:15:05.837Z","modified":"2026-11-02T15:54:45.159Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T18:00:08.034842Z"}],"euvd":[{"id":"EUVD-2026-109106","description":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.\n\nThe guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","status":"published","published":"2026-10-23T16:15:05Z","modified":"2026-11-02T15:54:45Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T05:08:40.251173Z"}],"ghsa":[{"id":"GHSA-7h83-3rfm-3p3v","title":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response...","description":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.\n\nThe guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","status":"published","published":"2026-10-23T18:31:37Z","modified":"2026-10-23T18:31:38Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T15:14:20.113334Z"}],"nvd":[{"id":"CVE-2026-105481","description":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.\n\nThe guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","status":"published","published":"2026-10-23T17:17:19.25Z","modified":"2026-11-02T16:17:23.327Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-367"],"updated_at":"2026-11-02T20:51:42.579129Z"}],"osv":[{"id":"ALPINE-CVE-2026-105481","description":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.\n\nThe guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","status":"published","published":"2026-10-23T17:17:19.25Z","modified":"2026-11-03T06:32:52.281615601Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"BELL-CVE-2026-105481","status":"published","published":"2026-10-24T06:08:18.483063Z","modified":"2026-11-01T07:15:03.910432928Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"DEBIAN-CVE-2026-105481","description":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.  The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.  This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","status":"published","published":"2026-10-23T17:17:19.25Z","modified":"2026-11-10T17:29:46.444227969Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-10T17:34:47.901646Z"},{"id":"RLSA-2026:92376","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T00:01:28.043412Z","modified":"2026-10-30T00:30:02.808138726Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92378","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:04:27.805649Z","modified":"2026-10-30T12:30:02.317716363Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-105481","description":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","status":"published","published":"2026-10-23T17:17:00Z","modified":"2026-10-28T20:15:21.930659533Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"ALSA-2026:92376","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n  * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n  * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n  * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n  * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n  * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:30:02.511793774Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:92378","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n  * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n  * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n  * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n  * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n  * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:45:02.311915713Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-111056","title":"CVE-2026-105481 affecting package nodejs for versions less than 24.22.1-0","description":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.\n\nThe guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","status":"published","published":"2026-10-23T17:17:19Z","modified":"2026-11-05T07:22:58Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"BIT-node-2026-105481","description":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.\n\nThe guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","status":"published","published":"2026-10-29T08:55:52.419Z","modified":"2026-10-29T10:56:09.695176337Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2026-105481","description":"A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.\n\nThe guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.","status":"published","published":"2026-10-29T08:56:05.702Z","modified":"2026-10-29T10:56:09.695176337Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CLSA-2026-1792746902","title":"nodejs: Fix of 3 CVEs","description":"- CVE-2026-105482: reject names and local addresses with null bytes in\n  the dns resolve*() and setLocalAddress() APIs, so c-ares can no longer\n  silently truncate the queried name\n- CVE-2026-106069, CVE-2026-106072: reject non-canonical IP spellings in\n  tls.checkServerIdentity() and restore IPv6 IP SAN matching, broken by\n  the CVE-2026-48618 fix since els15\n- CVE-2026-105481: check for unread data in the OS socket buffer before\n  http.Agent reuses a keep-alive socket and destroy the socket if any","status":"published","published":"2026-10-23T09:21:40Z","modified":"2026-10-26T09:43:56.796040469Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792760716","title":"nodejs: Fix of 3 CVEs","description":"- CVE-2026-105482: reject names and local addresses with null bytes in\n  the dns resolve*() and setLocalAddress() APIs, so c-ares can no longer\n  silently truncate the queried name\n- CVE-2026-106069, CVE-2026-106072: reject non-canonical IP spellings in\n  tls.checkServerIdentity() and restore IPv6 IP SAN matching, broken by\n  the CVE-2026-48618 fix since els15\n- CVE-2026-105481: check for unread data in the OS socket buffer before\n  http.Agent reuses a keep-alive socket and destroy the socket if any","status":"published","published":"2026-10-23T13:05:29Z","modified":"2026-10-26T09:43:59.329974296Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:12248-1","title":"corepack24-24.22.1-1.1 on GA media","description":"These are all security issues fixed in the corepack24-24.22.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:09.353383831Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22210-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nChanges for nodejs22:\n\n- Update to 22.23.4:\n - CVE-2026-106069, CVE-2026-106072 tls: reject non-canonical IP addresses (bsc#1286563, bsc#1286566)\n - CVE-2026-105482 dns: validate resolve inputs for null bytes (bsc#1286561)\n - CVE-2026-111497 deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (bsc#1286564)\n - CVE-2026-105481 http: ensure agent data guard works without I/O (bsc#1286565)\n - CVE-2026-106074 crypto: reset random caches across snapshots (bsc#1286567)\n - CVE-2026-106073 permission: check permission model in realpathSync (bsc#1286570)\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update sqlite to 3.53.4\n - deps: update undici to 6.29.1\n - deps: update corepack to 0.36.0\n - deps: upgrade npm to 10.9.9\n - deps: update icu to 78.3\n - node-api: support SharedArrayBuffer in napi_create_typedarray\n - node-api: add napi_create_external_sharedarraybuffer\n","status":"published","published":"2026-10-30T13:44:42Z","modified":"2026-11-04T17:23:22.432955577Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:24600-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nChanges for nodejs22:\n\n- Update to 22.23.4:\n - CVE-2026-106069, CVE-2026-106072 tls: reject non-canonical IP addresses (bsc#1286563, bsc#1286566)\n - CVE-2026-105482 dns: validate resolve inputs for null bytes (bsc#1286561)\n - CVE-2026-111497 deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (bsc#1286564)\n - CVE-2026-105481 http: ensure agent data guard works without I/O (bsc#1286565)\n - CVE-2026-106074 crypto: reset random caches across snapshots (bsc#1286567)\n - CVE-2026-106073 permission: check permission model in realpathSync (bsc#1286570)\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update sqlite to 3.53.4\n - deps: update undici to 6.29.1\n - deps: update corepack to 0.36.0\n - deps: upgrade npm to 10.9.9\n - deps: update icu to 78.3\n - node-api: support SharedArrayBuffer in napi_create_typedarray\n - node-api: add napi_create_external_sharedarraybuffer\n","status":"published","published":"2026-10-30T12:35:02Z","modified":"2026-11-09T17:23:10.345419001Z","updated_at":"2026-11-09T17:36:36.959817Z"},{"id":"SUSE-SU-2026:4957-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nChanges for nodejs22:\n\n- Update to 22.23.4:\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update sqlite to 3.53.4\n - deps: update undici to 6.29.1\n- Update to 22.23.3:\n - deps: update corepack to 0.36.0\n - deps: upgrade npm to 10.9.9\n - deps: update icu to 78.3\n - deps: update Undici to 6.28.1\n - node-api: support SharedArrayBuffer in napi_create_typedarray\n - node-api: add napi_create_external_sharedarraybuffer\n","status":"published","published":"2026-10-30T19:12:23Z","modified":"2026-11-02T17:23:10.023243683Z","updated_at":"2026-11-02T18:00:32.560004Z"},{"id":"SUSE-SU-2026:5036-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nChanges for nodejs22:\n\n- Update to 22.23.4:\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update sqlite to 3.53.4\n - deps: update undici to 6.29.1\n- Update to 22.23.3:\n - deps: update corepack to 0.36.0\n - deps: upgrade npm to 10.9.9\n - deps: update icu to 78.3\n - deps: update Undici to 6.28.1\n - node-api: support SharedArrayBuffer in napi_create_typedarray\n - node-api: add napi_create_external_sharedarraybuffer\n","status":"published","published":"2026-11-02T16:21:19Z","modified":"2026-11-03T13:15:08.774968427Z","updated_at":"2026-11-03T13:33:04.521148Z"},{"id":"SUSE-SU-2026:5037-1","title":"Security update for nodejs24","description":"This update for nodejs24 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits (bsc#1286562).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nNon security issue fixed:\n\n- 'npm install -h' output is truncated (bsc#1276224).\n\nChanges for nodejs24:\n\n- Update to 24.22.1:\n - crypto: update root certificates to NSS 3.131.1\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update undici to 7.30.1\n- Update to 24.22.0:\n - crypto: add crypto.parsePKCS12()\n - crypto: discover ciphers and hashes from OpenSSL providers\n - crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs\n - doc: deprecate Server.prototype._listen2 in node:net\n - net: support sending net.BoundSocket to threads and child processes\n - perf_hooks: implement SlidingWindowHistogram\n - perf_hooks: implement qrde analysis support in Histogram\n - perf_hooks: implement Histogram meanCI API\n - perf_hooks: add CBOR export/import for histogram exchange\n - sqlite: add StatementSync.prototype.close()\n - sqlite: add StatementSync.prototype[Symbol.dispose]()\n - src,lib: add util.markPromiseAsHandled\n - util: implement util.throttle\n - util: implement debounce\n- Update to 24.21.0:\n - crypto: update root certificates to NSS 3.126\n - crypto: support loading private keys through STORE loaders\n - deps: update Undici to 7.29.1\n - lib,src: improve histogram implementation\n - net: improve performance of net.BlockList\n - perf_hooks: add statistical hypothesis testing to histogram\n - util: add non-throwing MIMEType.parse\n- Update to 24.20.0:\n - async_hooks: add using scopes to AsyncLocalStorage\n - buffer: add end parameter\n - doc: add MikeMcC399 as collaborator\n - lib,permission: add permission.drop\n - loader: implement package maps\n - src,permission: add --permission-audit\n - stream: add node:stream/iter implementation\n - test_runner: add context.log() and test:log event\n - test_runner: report entryFile in TestStream events\n - wasm: enable JSPI\n- Update to 24.19.0:\n - buffer: implement blob.textStream()\n - deps: update OpenSSL build config to support compression\n - doc: update blockList stability status to release candidate\n - doc: mark stream.compose stable\n - esm: add --experimental-import-text flag\n - fs: support caller-supplied readFile() buffers\n - http: add httpValidation option to configure header value validation\n - net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive\n - perf_hooks: sample delay per event loop iteration\n - src: allow empty --experimental-config-file\n - stream: expose ReadableStreamTee\n - tls: report negotiated TLS groups\n - tls: add certificateCompression option\n","status":"published","published":"2026-11-02T16:21:32Z","modified":"2026-11-03T13:15:07.829767078Z","updated_at":"2026-11-03T13:33:04.521148Z"}]}}