DeutschShown in its original language — a full translation is planned for a future version.
Node.js: Mehrere Schwachstellen
view advisory published 2026-07-29
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um Dateien zu manipulieren.
01
describes (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-56848US | — | Exploit | ||
A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.… | ||||
| CVE-2026-58045US | — | — | ||
A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synch… | ||||
| CVE-2026-58044US | — | — | ||
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers wh… | ||||
| CVE-2026-58042US | — | — | ||
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.
Repeated triggering of this condition can lead to d… | ||||
| CVE-2026-58041US | — | — | ||
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been… | ||||
| CVE-2026-56846US | — | — | ||
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.
This vulnerability affects Node.js **24.x**… | ||||
| CVE-2026-58039US | — | — | ||
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.
This can lead to confidentiality impact or bypas… | ||||
| CVE-2026-58043US | high8.4 | — | ||
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
Under `--permission`, an attacker who is granted access to o… | ||||
| CVE-2026-58040US | — | — | ||
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).
This vul… | ||||
| CVE-2026-56850US | medium4.4 | — | ||
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with… | ||||
| CVE-2026-56847US | medium6.1 | — | ||
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.
This can lead to confidentiality impa… | ||||
| CVE-2026-48934US | — | — | ||
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-35841 vom 2026-08-01external
- Oracle Linux Security Advisory ELSA-2026-47058 vom 2026-08-01external
- Red Hat Security Advisory RHSA-2026:48273 vom 2026-07-30external
- Red Hat Security Advisory RHSA-2026:48305 vom 2026-07-30external
- Red Hat Security Advisory RHSA-2026:48537 vom 2026-07-30external
- Red Hat Security Advisory RHSA-2026:61376 vom 2026-08-31external
- Red Hat Security Advisory RHSA-2026:61377 vom 2026-08-31external
- Red Hat Security Advisory RHSA-2026:62219 vom 2026-09-02external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan