DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Node.js: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-10-21
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.
01
beschreibt (10)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-106074US | —OT erhöht | — | ||
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup sn… | ||||
| CVE-2026-106073US | — | — | ||
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which… | ||||
| CVE-2026-106072US | — | — | ||
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, su… | ||||
| CVE-2026-106071US | — | — | ||
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.
When the requested p… | ||||
| CVE-2026-106070US | — | — | ||
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.
When `zipEntry… | ||||
| CVE-2026-106069US | — | — | ||
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a n… | ||||
| CVE-2026-105483US | — | — | ||
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non… | ||||
| CVE-2026-105482US | — | Exploit | ||
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE… | ||||
| CVE-2026-105481US | — | — | ||
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CV… | ||||
| CVE-2026-111497US | — | Exploit | ||
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to co… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Node.js Security Release vom 2026-10-21external
- Node.js Security Release vom 2026-10-21external
- Node.js Security Release vom 2026-10-21external
- Node.js Security Release vom 2026-10-21external
- WID-SEC-W-2026-4117 - CSAF Versionself
- WID-SEC-2026-4117 - Portal Versionself
- PoC CVE-2026-111497 Node2Shellexternal
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan