SB20260921174 - SUSE update for nodejs18
Published: September 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 38 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2026-56848)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.
The vulnerability exists due to use-after-free in Node.js HTTP/2 handling when nghttp2_session_mem_send() is called re-entrantly while nghttp2_session_mem_recv() is executing. A remote attacker can trigger re-entrant HTTP/2 processing to cause a denial of service or potentially execute arbitrary code.
2) Resource exhaustion (CVE-ID: CVE-2026-48619)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in node:http2 clients when processing attacker-controlled ORIGIN frames. A remote attacker can send an unlimited number of ORIGIN frames to cause a denial of service.
The issue can lead to an out-of-memory condition on the client.
3) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-48928)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass mTLS authorization.
The vulnerability exists due to case-sensitive hostname matching in SNI context matching when selecting contexts in multi-context mTLS setups. A remote attacker can use an uppercase hostname to bypass mTLS authorization.
4) Improper Null Termination (CVE-ID: CVE-2026-48930)
CWE-ID: CWE-170 - Improper Null Termination
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass hostname-based authority checks.
The vulnerability exists due to c-string truncation in resolver bindings in TLS hostname handling when processing hostnames containing an embedded nul character. A remote attacker can present a crafted hostname to bypass hostname-based authority checks.
5) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-48931)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the HTTP response queue.
The vulnerability exists due to a time-of-check time-of-use race condition in http.Agent when accepting a response before the client has sent the request. A remote attacker can send a response early to poison the HTTP response queue.
6) Integer overflow (CVE-ID: CVE-2026-48933)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in the WebCrypto subtle.encrypt() implementation when processing input whose size is a multiple of 2 gib. A remote attacker can supply crafted input to cause a denial of service.
7) Improper Certificate Validation (CVE-ID: CVE-2026-48934)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate validation.
The vulnerability exists due to improper certificate validation in TLS host verification when reusing a session with a different servername. A remote attacker can reuse a session with a different servername to bypass certificate validation.
8) Improper access control (CVE-ID: CVE-2026-48935)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to modify file metadata outside intended permission restrictions.
The vulnerability exists due to improper access control in FileHandle.utimes() in the promises API when enforcing read-only filesystem permissions. A local user can invoke FileHandle.utimes() on a read-only path to modify file metadata outside intended permission restrictions.
9) Improper Resource Shutdown or Release (CVE-ID: CVE-2026-48937)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in the HTTP/2 server API when handling invalid protocol errors after sending a GOAWAY frame. A remote attacker can continue sending data to cause a denial of service.
10) Resource exhaustion (CVE-ID: CVE-2026-56846)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in Node.js HTTP/2 handling when processing retained header blocks. A remote attacker can send specially crafted HTTP/2 header blocks to cause a denial of service.
11) Input validation error (CVE-ID: CVE-2026-48618)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass tls wildcard-depth authentication.
The vulnerability exists due to improper input validation in TLS hostname handling when normalizing hostnames with unicode dot separators. A remote attacker can present a crafted hostname to bypass tls wildcard-depth authentication.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
12) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-56850)
CWE-ID: CWE-305 - Authentication Bypass by Primary Weakness
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to reuse mutual TLS client identities across requests configured with different client certificates.
The vulnerability exists due to improper connection reuse in the Node.js HTTPS Agent when reusing connections across requests configured with different PFX certificates. A remote user can cause PFX object-array key collisions to reuse mutual TLS client identities across requests configured with different client certificates.
13) Improper Certificate Validation (CVE-ID: CVE-2026-58040)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass hostname verification.
The vulnerability exists due to improper certificate validation in the Node.js HTTPS Agent when reusing TLS sessions across identity policies. A remote attacker can trigger TLS session reuse to bypass hostname verification.
This issue was identified as an incomplete fix for CVE-2026-48934.
14) Input validation error (CVE-ID: CVE-2026-58042)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input handling in dns.resolveAny() when processing DNS responses containing more than 256 A records. A remote attacker can send or induce such a DNS response to cause a denial of service.
Repeated triggering of this condition can abort the process.
15) Improper access control (CVE-ID: CVE-2026-58043)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read from or write to paths outside the intended filesystem allowlist.
The vulnerability exists due to improper access control in Node.js Permission Model path matching when handling radix-tree prefix boundaries under --permission. A local user can abuse prefix boundary handling to read from or write to paths outside the intended filesystem allowlist.
The issue applies only when the Permission Model is enabled with --permission.
16) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-58044)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform request smuggling.
The vulnerability exists due to inconsistent header processing in the Node.js HTTP client when rebuilding outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection. A remote attacker can send a crafted request with hidden framing headers to perform request smuggling.
The issue affects Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while reusing backend connections.
17) Input validation error (CVE-ID: CVE-2026-58045)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in the synchronous node:zlib APIs when processing a spoofed TypedArray byteLength. A local user can supply a crafted TypedArray value to cause a denial of service.
Repeated exploitation of this condition can crash the process.
18) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-6733)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause responses to be delivered to the wrong requests.
The vulnerability exists due to a time-of-check time-of-use race condition in the HTTP/1.1 client when reusing keep-alive sockets. A remote attacker can inject an unsolicited HTTP/1.1 response onto an idle socket to cause responses to be delivered to the wrong requests.
Exploitation requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.
19) CRLF injection (CVE-ID: CVE-2026-9679)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject arbitrary HTTP response headers.
The vulnerability exists due to improper neutralization of CRLF sequences in the parseSetCookie cookie parser when processing a crafted Set-Cookie header containing percent-encoded delimiter bytes. A remote attacker can supply a specially crafted upstream Set-Cookie header to inject arbitrary HTTP response headers.
Exploitation requires an application to parse a Set-Cookie header using parseSetCookie, parseCookie, or getSetCookies and then forward the parsed value into a downstream response header.
20) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-16728)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause downstream response desynchronization, connection hangs, or response corruption.
The vulnerability exists due to inconsistent interpretation of HTTP response framing in interceptors.retry() when retrying or resuming a partial upstream response. A remote attacker can send a partial response with mismatched framing headers to cause downstream response desynchronization, connection hangs, or response corruption.
The issue requires interceptors.retry() to be enabled and a downstream forwarder that forwards upstream headers and bodies without removing or recalculating Content-Length.
21) Improper error handling (CVE-ID: CVE-2025-23166)
CWE-ID: CWE-388 - Error Handling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect error handling in async cryptographic operations within the SignTraits::DeriveBits() function. A remote attacker can send specially crafted input to the application can crash the Node.js runtime.
22) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2025-23167)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP/1 headers in llhttp. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
23) Race condition (CVE-ID: CVE-2025-55131)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information or corrupt data.
The vulnerability exists due to a race condition in buffer allocation logic when using the vm module with the timeout option. A remote user can influence workload and timeout behavior to disclose sensitive information or corrupt data.
Exploitation typically requires precise timing or in-process code execution.
24) Uncaught Exception (CVE-ID: CVE-2025-59465)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper error handling in the HTTP/2 server when receiving a malformed HEADERS frame with oversized invalid HPACK data. A remote attacker can send a specially crafted HTTP/2 HEADERS frame to cause a denial of service.
This primarily affects applications that do not attach explicit error handlers to secure sockets.
25) Uncaught Exception (CVE-ID: CVE-2025-59466)
CWE-ID: CWE-248 - Uncaught Exception
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper error handling in async_hooks error handling when deep recursion occurs with async_hooks.createHook() enabled. A remote attacker can trigger deep recursion to cause a denial of service.
Applications using AsyncLocalStorage or async_hooks.createHook() are affected under specific conditions.
26) Use-after-free (CVE-ID: CVE-2025-62408)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6 [CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a use-after-free error within the read_answer() function when process_answer() terminates a query such as after maximum attempts. A remote attacker can perform a denial of service attack.
Note, the vulnerability exists due to an incomplete fix for #VU107155 (CVE-2025-31498).
27) Permissive List of Allowed Inputs (CVE-ID: CVE-2026-11525)
CWE-ID: CWE-183 - Permissive List of Allowed Inputs
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to weaken SameSite cookie policy enforcement.
The vulnerability exists due to permissive list of allowed inputs in the Set-Cookie header parser when parsing Set-Cookie headers from server responses. A remote attacker can send a specially crafted Set-Cookie header to weaken SameSite cookie policy enforcement.
The issue affects applications that forward or rely on the parsed sameSite attribute from server responses.
28) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-12151)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the WebSocket client message fragmentation handling when processing fragmented WebSocket messages from a server. A remote attacker can send many small or empty continuation frames to cause a denial of service.
Exploitation requires the application to connect to an attacker-controlled or compromised WebSocket endpoint using the WebSocket client or the WebSocketStream API.
29) CRLF injection (CVE-ID: CVE-2026-15157)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject arbitrary HTTP headers and potentially smuggle a second request past the upstream.
The vulnerability exists due to improper neutralization of CRLF sequences in lib/dispatcher/client-h1.js when processing a duck-typed blob-like body with an untrusted .type property through the HTTP/1.1 dispatcher. A remote attacker can supply crafted CRLF sequences in the .type value to inject arbitrary HTTP headers and potentially smuggle a second request past the upstream.
User interaction is required because exploitation occurs when an application passes untrusted input into a blob-like body's .type property. Native Blob is not affected, and fetch() is unaffected.
30) Use of insufficiently random values (CVE-ID: CVE-2025-22150)
CWE-ID: CWE-330 - Use of Insufficiently Random Values
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to the application uses "Math.random()" from the fetch() function to choose the boundary for a "multipart/form-data" request. A remote attacker with ability to intercept traffic can tamper with the requests going to the backend APIs.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass cookie security protections and modify cookie attributes.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in the setCookie function when processing user-controlled domain or unparsed setCookie fields. A remote attacker can supply crafted input containing cookie attributes to bypass cookie security protections and modify cookie attributes.
Exploitation requires an application to pass user-controlled input to these fields, such as in multi-tenant or reverse-proxy deployments.
32) Path manipulation (CVE-ID: CVE-2026-21637)
CWE-ID: CWE-249 - DEPRECATED: Often Misused: Path Manipulation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper error handling in _tls_wrap.js when processing TLS SNI handshake requests. A remote attacker can send a specially crafted request with unexpected servername input to cause an uncaught exception, crashing the Node.js process.
Exploitation occurs during TLS handshake when SNICallback is configured and throws synchronously.
33) Improper error handling (CVE-ID: CVE-2026-21710)
CWE-ID: CWE-388 - Error Handling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of special property names in HTTP headers in req.headersDistinct when parsing incoming HTTP requests. A remote attacker can send a request with a header named __proto__ to trigger a TypeError when the application accesses req.headersDistinct, crashing the Node.js process.
The exception occurs synchronously in a property getter and cannot be caught without wrapping every access in try/catch.
34) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-21713)
CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially forge message authentication codes.
The vulnerability exists due to use of non-constant-time comparison in HMAC verification in crypto_hmac.cc when validating user-provided signatures. A remote attacker can measure timing differences during signature comparison to infer valid HMAC values, acting as a timing oracle.
Exploitation requires high-resolution timing measurements and repeated queries under a favorable threat model.
35) Missing release of memory after effective lifetime (CVE-ID: CVE-2026-21714)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause resource exhaustion.
The vulnerability exists due to a memory leak in the HTTP/2 server implementation when processing WINDOW_UPDATE frames on stream 0. A remote attacker can send WINDOW_UPDATE frames that exceed the maximum flow control window, causing the Http2Session object to remain allocated despite sending a GOAWAY frame.
The server fails to clean up the Http2Session object after connection termination, leading to unbounded memory consumption.
36) Creation of chroot Jail Without Changing Working Directory (CVE-ID: CVE-2026-21717)
CWE-ID: CWE-243 - Creation of chroot Jail Without Changing Working Directory
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to predictable hash collisions in V8's string hashing mechanism when processing integer-like strings. A remote attacker can craft input with many colliding keys, degrading performance during JSON.parse() or other operations that internalize strings.
The most common trigger is endpoints parsing attacker-controlled JSON, leading to significant CPU and memory usage.
37) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-22036)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the fetch() API and undici decompress interceptor when processing HTTP responses with chained Content-Encoding values. A remote attacker can send a specially crafted response with thousands of compression steps to cause a denial of service.
38) Input validation error (CVE-ID: CVE-2026-27135)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing state validation in the nghttp2 session handling logic when processing malformed frames after session termination has been initiated. A remote attacker can send specially crafted frames to cause a denial of service.
For PRIORITY_UPDATE and ALTSVC frames, the affected extension types must be explicitly enabled. Builds with assertions disabled may not crash under the same conditions.
Remediation
Install update from vendor's website.