DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Node.js: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-06-18
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
01
beschreibt (13)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-48936US | — | — | ||
A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission.
This vulnerability affects one sup… | ||||
| CVE-2026-48935US | —OT erhöht | — | ||
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.
This vulnerability affects all su… | ||||
| CVE-2026-48934US | — | — | ||
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.… | ||||
| CVE-2026-48933US | — | — | ||
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.
This vulnerability affects all supported release lines… | ||||
| CVE-2026-48930US | critical9.8 | — | ||
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.
This vulnerabili… | ||||
| CVE-2026-48928US | medium5.4 | — | ||
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.
This vulnerability affects all supported release lines: **Node.js 22**… | ||||
| CVE-2026-48619US | high7.5 | — | ||
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.
This vulnerability affect… | ||||
| CVE-2026-48618US | medium6.5 | — | ||
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname… | ||||
| CVE-2026-48615US | high7.5 | — | ||
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.
When proxy credentials are embedded in the proxy URL, they may… | ||||
| CVE-2026-48931US | low3.7 | — | ||
A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.
This vulnerability affects all supported relea… | ||||
| CVE-2026-48937US | high7.5 | — | ||
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js… | ||||
| CVE-2026-48617US | high8.2 | — | ||
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intende… | ||||
| CVE-2026-21636US | critical10.0 | Exploit | ||
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Oracle Linux Security Advisory ELSA-2026-35841 vom 2026-08-01external
- Oracle Linux Security Advisory ELSA-2026-35842 vom 2026-08-04external
- Oracle Linux Security Advisory ELSA-2026-47058 vom 2026-08-01external
- Red Hat Security Advisory RHSA-2026:28727 vom 2026-06-27external
- Red Hat Security Advisory RHSA-2026:29012 vom 2026-06-27external
- Red Hat Security Advisory RHSA-2026:30172 vom 2026-06-27external
- Red Hat Security Advisory RHSA-2026:35841 vom 2026-07-06external
- Red Hat Security Advisory RHSA-2026:35842 vom 2026-07-06external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan