SB2026072975 - Multiple vulnerabilities in Node.js

Description

This security bulletin contains information about 11 vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2026-56846)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in Node.js HTTP/2 handling when processing retained header blocks. A remote attacker can send specially crafted HTTP/2 header blocks to cause a denial of service.

2) Use-after-free (CVE-ID: CVE-2026-56848)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.

The vulnerability exists due to use-after-free in Node.js HTTP/2 handling when nghttp2_session_mem_send() is called re-entrantly while nghttp2_session_mem_recv() is executing. A remote attacker can trigger re-entrant HTTP/2 processing to cause a denial of service or potentially execute arbitrary code.

3) Improper access control (CVE-ID: CVE-2026-58043)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to read from or write to paths outside the intended filesystem allowlist.

The vulnerability exists due to improper access control in Node.js Permission Model path matching when handling radix-tree prefix boundaries under --permission. A local user can abuse prefix boundary handling to read from or write to paths outside the intended filesystem allowlist.

The issue applies only when the Permission Model is enabled with --permission.

4) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-56850)

CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to reuse mutual TLS client identities across requests configured with different client certificates.

The vulnerability exists due to improper connection reuse in the Node.js HTTPS Agent when reusing connections across requests configured with different PFX certificates. A remote user can cause PFX object-array key collisions to reuse mutual TLS client identities across requests configured with different client certificates.

5) Improper Certificate Validation (CVE-ID: CVE-2026-58040)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass hostname verification.

The vulnerability exists due to improper certificate validation in the Node.js HTTPS Agent when reusing TLS sessions across identity policies. A remote attacker can trigger TLS session reuse to bypass hostname verification.

This issue was identified as an incomplete fix for CVE-2026-48934.

6) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-58041)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to re-execute writes with new parameters.

The vulnerability exists due to improper state management in node:sqlite SQLTagStore when a stale StatementSyncIterator continues executing a cached prepared statement after it has been reset and rebound with new parameters. A local user can reuse a stale iterator to re-execute writes with new parameters.

The issue involves StatementSyncIterator objects created through DatabaseSync#createTagStore().

7) Input validation error (CVE-ID: CVE-2026-58042)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input handling in dns.resolveAny() when processing DNS responses containing more than 256 A records. A remote attacker can send or induce such a DNS response to cause a denial of service.

Repeated triggering of this condition can abort the process.

8) Input validation error (CVE-ID: CVE-2026-58045)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the synchronous node:zlib APIs when processing a spoofed TypedArray byteLength. A local user can supply a crafted TypedArray value to cause a denial of service.

Repeated exploitation of this condition can crash the process.

9) Improper access control (CVE-ID: CVE-2026-56847)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to write trace logs outside allowed filesystem paths.

The vulnerability exists due to improper access control in Node.js Permission Model enforcement when trace_events.createTracing().enable() writes trace logs. A local user can invoke trace_events.createTracing().enable() to write trace logs outside allowed filesystem paths.

This issue affects configurations that use the Permission Model with --allow-fs-write restrictions.

10) Improper access control (CVE-ID: CVE-2026-58039)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to write or overwrite files outside allowed filesystem paths.

The vulnerability exists due to improper access control in Node.js Permission Model enforcement when process.report writes files. A local user can invoke process.report to write or overwrite files outside allowed filesystem paths.

This issue affects configurations that use --allow-fs-write restrictions.

11) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-58044)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform request smuggling.

The vulnerability exists due to inconsistent header processing in the Node.js HTTP client when rebuilding outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection. A remote attacker can send a crafted request with hidden framing headers to perform request smuggling.

The issue affects Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while reusing backend connections.

Remediation

Install update from vendor's website.

References

• https://nodejs.org/en/blog/vulnerability/july-2026-security-releases