{"id":"CVE-2026-105482","aliases":["ALPINE-CVE-2026-105482","ALSA-2026:92376","ALSA-2026:92378","ALSA-2026:96088","ALSA-2026:96094","ALSA-2026:96234","AZL-111035","BELL-CVE-2026-105482","BIT-node-2026-105482","BIT-node-min-2026-105482","CLSA-2026-1792746902","CLSA-2026-1792760716","DEBIAN-CVE-2026-105482","EUVD-2026-109105","GHSA-4qmx-59c6-fr6r","RLSA-2026:92376","RLSA-2026:92378","RLSA-2026:96088","RLSA-2026:96094","RLSA-2026:96234","SUSE-SU-2026:24600-1","SUSE-SU-2026:4957-1","SUSE-SU-2026:5036-1","SUSE-SU-2026:5037-1","UBUNTU-CVE-2026-105482","openSUSE-SU-2026:12248-1","openSUSE-SU-2026:22210-1"],"status":"published","title":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated...","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.","severity":{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00468,"percentile":0.40847,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-284"],"published":"2026-10-23T00:00:00Z","modified":"2026-11-10T17:29:46Z","exploits":[{"source":"pocgithub","id":"CaterMaoZi/CVE-2026-105482-POC","title":"CaterMaoZi/CVE-2026-105482-POC","date":"2026-10-21","url":"https://github.com/CaterMaoZi/CVE-2026-105482-POC"},{"source":"pocgithub","id":"CompleteTech-Security/node-cve-2026-105482-check","title":"CompleteTech-Security/node-cve-2026-105482-check","date":"2026-10-23","url":"https://github.com/CompleteTech-Security/node-cve-2026-105482-check"},{"source":"pocgithub","id":"EthanTech-Offical/CVE-2026-105482-Reproduce","title":"EthanTech-Offical/CVE-2026-105482-Reproduce","date":"2026-10-28","url":"https://github.com/EthanTech-Offical/CVE-2026-105482-Reproduce"}],"fixes":[{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["22.23.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["22.23.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["26.12.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["24.22.1-0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nodejs22","fixed_in":["22.23.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nodejs24","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nodejs26","fixed_in":["26.12.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs22","fixed_in":["22.23.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs24","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs26","fixed_in":["26.12.1-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nodejs22","fixed_in":["22.23.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nodejs24","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nodejs26","fixed_in":["26.12.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs22","fixed_in":["22.23.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs24","fixed_in":["24.22.1-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs26","fixed_in":["26.12.1-r1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["22.23.4","24.22.1","26.12.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["22.23.4","24.22.1","26.12.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["24.22.1+dfsg+~cs24.19.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.12.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-2.module_el8.10.0+4250+09238ed4"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el8.10.0+4086+70facd4a"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:8","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-3.module_el9.8.0+292+f4eaf8b2"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:9","package":"v8-13.6-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075"}]}],"bundled":13},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs24-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:11.19.1-1.24.22.1.3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.9-1.22.23.4.1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+227+12323393"}]}],"bundled":7},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.23.2-r1"},{"fixed":"22.23.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.18.1-r0"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.0-r0"},{"fixed":"26.12.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.23.2-r0"},{"fixed":"22.23.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.18.1-r3"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.0-r0"},{"fixed":"26.12.1-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.23.2-r1"},{"fixed":"22.23.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.18.1-r0"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.0-r0"},{"fixed":"26.12.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"22.23.2-r0"},{"fixed":"22.23.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.18.1-r3"},{"fixed":"24.22.1-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.7.0-r0"},{"fixed":"26.12.1-r1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"22.23.4"},{"introduced":"23.0.0"},{"fixed":"24.22.1"},{"introduced":"25.0.0"},{"fixed":"26.12.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"22.23.4"},{"introduced":"23.0.0"},{"fixed":"24.22.1"},{"introduced":"25.0.0"},{"fixed":"26.12.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-8.el9_2.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els24"}]}],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1","18.13.0+dfsg1-1.1","18.19.0+dfsg-1","18.19.0+dfsg-2","18.19.0+dfsg-3","18.19.0+dfsg-4","18.19.0+dfsg-5","18.19.0+dfsg-6","18.19.0+dfsg-6~deb12u1","18.19.0+dfsg-6~deb12u2","18.19.1+dfsg-1","18.19.1+dfsg-2","18.19.1+dfsg-3","18.19.1+dfsg-3.1","18.19.1+dfsg-4","18.19.1+dfsg-6","18.20.1+dfsg-1","18.20.1+dfsg-2","18.20.1+dfsg-3","18.20.1+dfsg-4","18.20.4+dfsg-1~deb12u1","18.20.4+dfsg-1~deb12u2","18.20.4+dfsg-1~deb12u3","20.10.0+dfsg-1","20.12.2+dfsg-1","20.13.0+dfsg-1","20.13.1+dfsg-1","20.13.1+dfsg-2","20.14.0+dfsg-1","20.14.0+dfsg-2","20.14.0+dfsg-3","20.15.0+dfsg-1","20.15.1+dfsg-1","20.16.0+dfsg-1","20.17.0+dfsg-1","20.17.0+dfsg-2","20.18.0+dfsg-1","20.18.0+dfsg-2","20.18.1+dfsg-1","20.18.1+dfsg-2","20.18.2+dfsg-1","20.18.2+dfsg-2","20.18.2+dfsg-3","20.18.2+dfsg-4","20.18.3+dfsg-1","20.19.0+dfsg-1","20.19.0+dfsg-2","20.19.0+dfsg1-1","20.19.2+dfsg-1","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1","24.19.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-2","24.21.0+dfsg+~cs24.13.4-1","24.22.0+dfsg+~cs24.19.2-1","24.22.0+dfsg+~cs24.19.2-2","24.22.1+dfsg+~cs24.19.2-1","24.22.2+dfsg+~cs24.19.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.19.2+dfsg-1","20.19.2+dfsg-1+deb13u1","20.19.2+dfsg-1+deb13u2","20.19.2+dfsg-1+deb13u3","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1","24.19.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-2","24.21.0+dfsg+~cs24.13.4-1","24.22.0+dfsg+~cs24.19.2-1","24.22.0+dfsg+~cs24.19.2-2","24.22.1+dfsg+~cs24.19.2-1","24.22.2+dfsg+~cs24.19.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1+dfsg+~cs24.19.2-1"}]}],"versions":["20.19.2+dfsg-1","20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-1","20.19.5+dfsg+~cs20.19.12-2","20.19.5+dfsg+~cs20.19.12-3","20.19.5+dfsg+~cs20.19.12-4","20.19.5+dfsg+~cs20.19.24-1","22.12.0+dfsg-1","22.12.0+dfsg-2","22.12.0+dfsg-3","22.14.0+dfsg-1","22.18.0+dfsg+~cs22.17.2-1","22.18.0+dfsg+~cs22.17.2-2","22.18.0+dfsg-1","22.19.0+dfsg+~cs22.18.0-1","22.21.1+dfsg+~cs22.19.0-1","22.21.1+dfsg+~cs22.19.0-2","22.21.1+dfsg+~cs22.19.0-3","22.21.1+dfsg+~cs22.19.0-4","22.21.1+dfsg+~cs22.19.0-5","22.21.1+dfsg+~cs22.19.0-6","22.22.0+dfsg+~cs22.19.13-1","22.22.0+dfsg+~cs22.19.13-2","22.22.0+dfsg+~cs22.19.6-1","22.22.1+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-1","22.22.2+dfsg+~cs22.19.15-3","24.11.1+dfsg+~cs24.10.1-1","24.11.1+dfsg+~cs24.10.1-2","24.12.0+dfsg+~cs24.10.4-1","24.13.0+dfsg+~cs24.10.7-1","24.13.0+dfsg+~cs24.10.7-2","24.14.0+dfsg+~cs24.12.0-1","24.14.0+dfsg+~cs24.12.0-2","24.14.1+dfsg+~cs24.12.0-1","24.15.0+dfsg+~cs24.12.2-1","24.16.0+dfsg+~cs24.13.1-1","24.16.0+dfsg+~cs24.13.1-2","24.17.0+dfsg+~cs24.13.2-1","24.18.0+dfsg+~cs24.13.2-1","24.19.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-1","24.20.0+dfsg+~cs24.13.3-2","24.21.0+dfsg+~cs24.13.4-1","24.22.0+dfsg+~cs24.19.2-1","24.22.0+dfsg+~cs24.19.2-2"]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40277+b1b3f89e"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el8.10.0+40278+50b003a3"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40048+6d99f608"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40171+8fa9c325"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el8.10.0+40172+38f6fdd1"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.module+el9.8.0+40401+e24b8c95"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+40281+14cc6568"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":13},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.22.1-3.el10_2"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.4-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-3.module+el9.8.0+40281+14cc6568"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40165+d075e3f2"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40052+e32ea525"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.7.0+40153+4d595597"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.8.0+40164+8921ab53"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-150600.13.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-150600.13.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-150700.3.21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-150700.15.21.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.15~dfsg1-4","0.10.21~dfsg1-1","0.10.22~dfsg1-2","0.10.23~dfsg1-1","0.10.23~dfsg1-2","0.10.23~dfsg1-3","0.10.24~dfsg1-1","0.10.25~dfsg2-2","0.10.25~dfsg2-2ubuntu1","0.10.25~dfsg2-2ubuntu1.2","0.10.25~dfsg2-2ubuntu1.2+esm1","0.10.25~dfsg2-2ubuntu1.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3","8.10.0~dfsg-2ubuntu0.4+esm4","8.10.0~dfsg-2ubuntu0.4+esm5","8.10.0~dfsg-2ubuntu0.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.15.2~dfsg-2ubuntu1","10.17.0~dfsg-2ubuntu4","10.17.0~dfsg-2ubuntu6","10.19.0~dfsg-3ubuntu1","10.19.0~dfsg-3ubuntu1.1","10.19.0~dfsg-3ubuntu1.2","10.19.0~dfsg-3ubuntu1.3","10.19.0~dfsg-3ubuntu1.5","10.19.0~dfsg-3ubuntu1.6","10.19.0~dfsg-3ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.13.0+dfsg1-1ubuntu2","18.19.1+dfsg-2ubuntu4","18.19.1+dfsg-6ubuntu1","18.19.1+dfsg-6ubuntu2","18.19.1+dfsg-6ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.22.1+dfsg+~cs22.19.15-1ubuntu1","24.16.0+dfsg+~cs24.13.1-2ubuntu1","24.18.0+dfsg+~cs24.13.2-1ubuntu1","24.19.0+dfsg+~cs24.13.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.19.4+dfsg-1","20.19.5+dfsg+~cs20.19.12-4","22.21.1+dfsg+~cs22.19.0-6ubuntu4","22.22.0+dfsg+~cs22.19.6-1ubuntu2","22.22.0+dfsg+~cs22.19.13-2ubuntu1","22.22.1+dfsg+~cs22.19.15-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.22.1-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.23.4-160000.1.1"}]}],"bundled":7}],"products":[{"vendor":"nodejs","product":"node"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105482","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4qmx-59c6-fr6r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-105482","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92376","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101911","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102276","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102277","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102278","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105481","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105482","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105483","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106069","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106071","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106072","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106073","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106074","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-111497","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542596","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542706","tags":["report"]},{"url":"https://bugzilla.redhat.com/2542707","tags":["report"]},{"url":"https://bugzilla.redhat.com/2558973","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559875","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560016","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560019","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560021","tags":["report"]},{"url":"https://bugzilla.redhat.com/2560022","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-92376.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92378","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-92378.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96088","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109383","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109829","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109869","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553656","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553677","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553678","tags":["report"]},{"url":"https://bugzilla.redhat.com/2553679","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96088.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96094","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96094.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:96234","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-96234.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-105482","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792746902.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105481","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106069","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792760716.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-105482","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92376","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2560022","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92378","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96088","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553677","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553678","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553679","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96094","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96234","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624600-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286261","tags":["report"]},{"url":"https://bugzilla.suse.com/1286561","tags":["report"]},{"url":"https://bugzilla.suse.com/1286563","tags":["report"]},{"url":"https://bugzilla.suse.com/1286564","tags":["report"]},{"url":"https://bugzilla.suse.com/1286565","tags":["report"]},{"url":"https://bugzilla.suse.com/1286566","tags":["report"]},{"url":"https://bugzilla.suse.com/1286567","tags":["report"]},{"url":"https://bugzilla.suse.com/1286570","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-106074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111497","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264957-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265036-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265037-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262274","tags":["report"]},{"url":"https://bugzilla.suse.com/1266318","tags":["report"]},{"url":"https://bugzilla.suse.com/1276224","tags":["report"]},{"url":"https://bugzilla.suse.com/1286562","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105483","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-105482","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105482","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#dnsresolve-truncates-names-containing-nul-char-cve-2026-105482---high","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-105482","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.","status":"published","published":"2026-10-23T16:15:05.831Z","modified":"2026-11-02T15:51:54.058Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T18:00:08.034842Z"}],"euvd":[{"id":"EUVD-2026-109105","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.","status":"published","published":"2026-10-23T16:15:05Z","modified":"2026-11-02T15:51:54Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T05:08:40.757493Z"}],"ghsa":[{"id":"GHSA-4qmx-59c6-fr6r","title":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated...","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\n\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\n\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.","status":"published","published":"2026-10-23T18:31:38Z","modified":"2026-10-23T18:31:38Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:14:20.113334Z"}],"nvd":[{"id":"CVE-2026-105482","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.","status":"published","published":"2026-10-23T17:17:19.427Z","modified":"2026-11-02T16:17:23.48Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T20:51:42.579129Z"}],"osv":[{"id":"ALPINE-CVE-2026-105482","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.","status":"published","published":"2026-10-23T17:17:19.427Z","modified":"2026-11-03T06:33:01.350038208Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"BELL-CVE-2026-105482","status":"published","published":"2026-10-24T06:06:22.15409Z","modified":"2026-11-01T07:15:03.913290101Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"DEBIAN-CVE-2026-105482","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r \r Because the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r \r This vulnerability affects Node.js 26.x, 24.x, and 22.x.","status":"published","published":"2026-10-23T17:17:19.427Z","modified":"2026-11-10T17:29:46.463950092Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-10T17:34:47.901646Z"},{"id":"RLSA-2026:92376","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T00:01:28.043412Z","modified":"2026-10-30T00:30:02.808138726Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92378","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:04:27.805649Z","modified":"2026-10-30T12:30:02.317716363Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:96088","title":"Important: nodejs24 security, bug fix, and enhancement update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-295759)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:02.486941765Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:96094","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:02.483801869Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"RLSA-2026:96234","title":"Important: nodejs:22 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-302833)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T00:04:46.01358Z","modified":"2026-11-10T00:30:02.627933753Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T00:42:40.753497Z"},{"id":"UBUNTU-CVE-2026-105482","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.","status":"published","published":"2026-10-23T17:17:00Z","modified":"2026-10-28T20:17:39.914369972Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"ALSA-2026:92376","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n  * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n  * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n  * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n  * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n  * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:30:02.511793774Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:92378","title":"Important: nodejs:24 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n  * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n  * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n  * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n  * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n  * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:45:02.311915713Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:96088","title":"Important: nodejs24 security, bug fix, and enhancement update","description":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n  * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n  * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n  * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n  * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-295759)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.3776558Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"ALSA-2026:96094","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n  * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n  * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n  * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T12:00:02.399791109Z","updated_at":"2026-11-10T12:28:36.765058Z"},{"id":"ALSA-2026:96234","title":"Important: nodejs:22 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n  * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n  * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n  * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n  * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n  * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n  * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:RHEL-302833)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T10:45:02.706366594Z","updated_at":"2026-11-10T10:57:25.458985Z"},{"id":"AZL-111035","title":"CVE-2026-105482 affecting package nodejs for versions less than 24.22.1-0","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.","status":"published","published":"2026-10-23T17:17:19Z","modified":"2026-11-05T07:22:58Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"BIT-node-2026-105482","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.","status":"published","published":"2026-10-29T08:55:53.773Z","modified":"2026-10-29T10:56:11.695172887Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2026-105482","description":"A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.","status":"published","published":"2026-10-29T08:56:07.145Z","modified":"2026-10-29T10:56:11.695172887Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CLSA-2026-1792746902","title":"nodejs: Fix of 3 CVEs","description":"- CVE-2026-105482: reject names and local addresses with null bytes in\n  the dns resolve*() and setLocalAddress() APIs, so c-ares can no longer\n  silently truncate the queried name\n- CVE-2026-106069, CVE-2026-106072: reject non-canonical IP spellings in\n  tls.checkServerIdentity() and restore IPv6 IP SAN matching, broken by\n  the CVE-2026-48618 fix since els15\n- CVE-2026-105481: check for unread data in the OS socket buffer before\n  http.Agent reuses a keep-alive socket and destroy the socket if any","status":"published","published":"2026-10-23T09:21:40Z","modified":"2026-10-26T09:43:56.796040469Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792760716","title":"nodejs: Fix of 3 CVEs","description":"- CVE-2026-105482: reject names and local addresses with null bytes in\n  the dns resolve*() and setLocalAddress() APIs, so c-ares can no longer\n  silently truncate the queried name\n- CVE-2026-106069, CVE-2026-106072: reject non-canonical IP spellings in\n  tls.checkServerIdentity() and restore IPv6 IP SAN matching, broken by\n  the CVE-2026-48618 fix since els15\n- CVE-2026-105481: check for unread data in the OS socket buffer before\n  http.Agent reuses a keep-alive socket and destroy the socket if any","status":"published","published":"2026-10-23T13:05:29Z","modified":"2026-10-26T09:43:59.329974296Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:12248-1","title":"corepack24-24.22.1-1.1 on GA media","description":"These are all security issues fixed in the corepack24-24.22.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:09.353383831Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22210-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nChanges for nodejs22:\n\n- Update to 22.23.4:\n - CVE-2026-106069, CVE-2026-106072 tls: reject non-canonical IP addresses (bsc#1286563, bsc#1286566)\n - CVE-2026-105482 dns: validate resolve inputs for null bytes (bsc#1286561)\n - CVE-2026-111497 deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (bsc#1286564)\n - CVE-2026-105481 http: ensure agent data guard works without I/O (bsc#1286565)\n - CVE-2026-106074 crypto: reset random caches across snapshots (bsc#1286567)\n - CVE-2026-106073 permission: check permission model in realpathSync (bsc#1286570)\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update sqlite to 3.53.4\n - deps: update undici to 6.29.1\n - deps: update corepack to 0.36.0\n - deps: upgrade npm to 10.9.9\n - deps: update icu to 78.3\n - node-api: support SharedArrayBuffer in napi_create_typedarray\n - node-api: add napi_create_external_sharedarraybuffer\n","status":"published","published":"2026-10-30T13:44:42Z","modified":"2026-11-04T17:23:22.432955577Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:24600-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nChanges for nodejs22:\n\n- Update to 22.23.4:\n - CVE-2026-106069, CVE-2026-106072 tls: reject non-canonical IP addresses (bsc#1286563, bsc#1286566)\n - CVE-2026-105482 dns: validate resolve inputs for null bytes (bsc#1286561)\n - CVE-2026-111497 deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (bsc#1286564)\n - CVE-2026-105481 http: ensure agent data guard works without I/O (bsc#1286565)\n - CVE-2026-106074 crypto: reset random caches across snapshots (bsc#1286567)\n - CVE-2026-106073 permission: check permission model in realpathSync (bsc#1286570)\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update sqlite to 3.53.4\n - deps: update undici to 6.29.1\n - deps: update corepack to 0.36.0\n - deps: upgrade npm to 10.9.9\n - deps: update icu to 78.3\n - node-api: support SharedArrayBuffer in napi_create_typedarray\n - node-api: add napi_create_external_sharedarraybuffer\n","status":"published","published":"2026-10-30T12:35:02Z","modified":"2026-11-09T17:23:10.345419001Z","updated_at":"2026-11-09T17:36:36.959817Z"},{"id":"SUSE-SU-2026:4957-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nChanges for nodejs22:\n\n- Update to 22.23.4:\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update sqlite to 3.53.4\n - deps: update undici to 6.29.1\n- Update to 22.23.3:\n - deps: update corepack to 0.36.0\n - deps: upgrade npm to 10.9.9\n - deps: update icu to 78.3\n - deps: update Undici to 6.28.1\n - node-api: support SharedArrayBuffer in napi_create_typedarray\n - node-api: add napi_create_external_sharedarraybuffer\n","status":"published","published":"2026-10-30T19:12:23Z","modified":"2026-11-02T17:23:10.023243683Z","updated_at":"2026-11-02T18:00:32.560004Z"},{"id":"SUSE-SU-2026:5036-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nChanges for nodejs22:\n\n- Update to 22.23.4:\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update sqlite to 3.53.4\n - deps: update undici to 6.29.1\n- Update to 22.23.3:\n - deps: update corepack to 0.36.0\n - deps: upgrade npm to 10.9.9\n - deps: update icu to 78.3\n - deps: update Undici to 6.28.1\n - node-api: support SharedArrayBuffer in napi_create_typedarray\n - node-api: add napi_create_external_sharedarraybuffer\n","status":"published","published":"2026-11-02T16:21:19Z","modified":"2026-11-03T13:15:08.774968427Z","updated_at":"2026-11-03T13:33:04.521148Z"},{"id":"SUSE-SU-2026:5037-1","title":"Security update for nodejs24","description":"This update for nodejs24 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent (bsc#1286565).\n- CVE-2026-105482: dns.resolve truncates names containing NUL char (bsc#1286561).\n- CVE-2026-105483: TLS certificate hostname bypass when the IP is written fullwidth digits (bsc#1286562).\n- CVE-2026-106069: TLS certificate hostname bypass when the host loosely resolves to an IP address (bsc#1286563).\n- CVE-2026-106072: Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP\n  endpoints (bsc#1286566).\n- CVE-2026-106073: Permission Model bypass with fs.realpathSync (bsc#1286570).\n- CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and\n  SEAs, so every process repeats the same values (bsc#1286567).\n- CVE-2026-111497: Node.js Brotli decoder out-of-bounds write permits remote code execution (bsc#1286564).\n\nNon security issue fixed:\n\n- 'npm install -h' output is truncated (bsc#1276224).\n\nChanges for nodejs24:\n\n- Update to 24.22.1:\n - crypto: update root certificates to NSS 3.131.1\n - deps: update c-ares to 1.34.9\n - deps: update timezone to 2026e\n - deps: upgrade openssl sources to openssl-3.5.9\n - deps: update undici to 7.30.1\n- Update to 24.22.0:\n - crypto: add crypto.parsePKCS12()\n - crypto: discover ciphers and hashes from OpenSSL providers\n - crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs\n - doc: deprecate Server.prototype._listen2 in node:net\n - net: support sending net.BoundSocket to threads and child processes\n - perf_hooks: implement SlidingWindowHistogram\n - perf_hooks: implement qrde analysis support in Histogram\n - perf_hooks: implement Histogram meanCI API\n - perf_hooks: add CBOR export/import for histogram exchange\n - sqlite: add StatementSync.prototype.close()\n - sqlite: add StatementSync.prototype[Symbol.dispose]()\n - src,lib: add util.markPromiseAsHandled\n - util: implement util.throttle\n - util: implement debounce\n- Update to 24.21.0:\n - crypto: update root certificates to NSS 3.126\n - crypto: support loading private keys through STORE loaders\n - deps: update Undici to 7.29.1\n - lib,src: improve histogram implementation\n - net: improve performance of net.BlockList\n - perf_hooks: add statistical hypothesis testing to histogram\n - util: add non-throwing MIMEType.parse\n- Update to 24.20.0:\n - async_hooks: add using scopes to AsyncLocalStorage\n - buffer: add end parameter\n - doc: add MikeMcC399 as collaborator\n - lib,permission: add permission.drop\n - loader: implement package maps\n - src,permission: add --permission-audit\n - stream: add node:stream/iter implementation\n - test_runner: add context.log() and test:log event\n - test_runner: report entryFile in TestStream events\n - wasm: enable JSPI\n- Update to 24.19.0:\n - buffer: implement blob.textStream()\n - deps: update OpenSSL build config to support compression\n - doc: update blockList stability status to release candidate\n - doc: mark stream.compose stable\n - esm: add --experimental-import-text flag\n - fs: support caller-supplied readFile() buffers\n - http: add httpValidation option to configure header value validation\n - net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive\n - perf_hooks: sample delay per event loop iteration\n - src: allow empty --experimental-config-file\n - stream: expose ReadableStreamTee\n - tls: report negotiated TLS groups\n - tls: add certificateCompression option\n","status":"published","published":"2026-11-02T16:21:32Z","modified":"2026-11-03T13:15:07.829767078Z","updated_at":"2026-11-03T13:33:04.521148Z"}]}}