SB2026102621 - Multiple vulnerabilities in Node.js

Description

This security bulletin contains information about 10 vulnerabilities.

1) Improper Neutralization of Null Byte or NUL Character (CVE-ID: CVE-2026-105482)

CWE-ID: CWE-158 - Improper Neutralization of Null Byte or NUL Character

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass hostname-based validation and cause an application to use DNS records for a different domain.

The vulnerability exists due to improper handling of embedded null bytes in Node.js dns.resolve*() and dns.reverse() when passing hostnames to c-ares as C strings. A remote attacker can supply a hostname such as attacker.example.trusted.example to an application that validates the full hostname before resolution, causing the resolver to query attacker.example instead and potentially bypass domain allowlist restrictions.

2) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-105483)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass TLS endpoint identity verification using a certificate without a matching IP address subject alternative name.

The vulnerability exists due to improper certificate hostname validation in Node.js tls.checkServerIdentity() when an IPv4 host is written with non-ASCII characters, such as １２７.0.0.1. A remote attacker can present a certificate containing DNS:127.0.0.1 or DNS:*.0.0.1 to have the endpoint accepted through DNS-name or Common Name matching instead of the required IP address verification.

3) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-106069)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to authenticate a TLS server using a certificate issued for a different IP address.

The vulnerability exists due to inconsistent IP address interpretation in Node.js tls.checkServerIdentity() and the operating system resolver when connecting to a non-canonical IPv4 literal with a leading zero. A remote attacker can serve a certificate for 87.0.0.1 at the connected address 127.0.0.1 when the client uses 0127.0.0.1, exploiting octal interpretation during certificate validation and decimal interpretation during connection establishment to bypass endpoint identity verification.

Exploitation depends on resolver behavior that interprets the leading-zero octet as decimal, as described for platforms such as macOS.

4) Out-of-bounds write (CVE-ID: CVE-2026-111497)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt process memory, potentially execute arbitrary code, disclose process memory, or cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the Brotli decoder bundled with Node.js when an invalid block switch is treated as a temporary need for input rather than a permanent format error. A remote attacker can supply malformed Brotli data that an application decompresses with node:zlib to make the streaming decoder append bytes beyond an eight-byte internal buffer, potentially causing code execution, process memory disclosure, or a crash.

5) Race condition (CVE-ID: CVE-2026-105481)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause an HTTP client to accept an unsolicited response as the response to a subsequent request.

The vulnerability exists due to a timing-dependent gap in unexpected-data checks in Node.js HTTP Agent connection reuse when an idle keep-alive socket is assigned to a new request before pending data has been read. A remote attacker can send an unsolicited response over the idle connection before the next request is sent to have that response parsed as valid data for the new request.

6) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-106072)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass TLS endpoint identity verification using a certificate with a numeric DNS subject alternative name but no matching IP address subject alternative name.

The vulnerability exists due to improper certificate hostname validation in Node.js tls.checkServerIdentity() when non-canonical IPv4 literals are normalized but not classified as IP addresses. A remote attacker can present a certificate containing DNS:127.0.0.1 without IP Address:127.0.0.1 when a client connects using 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1 to have the certificate incorrectly accepted for the IP endpoint.

Exploitation requires a certificate issued by a CA trusted by the client and a platform resolver that accepts these non-canonical spellings, such as glibc.

7) Use of insufficiently random values (CVE-ID: CVE-2026-106074)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to predict values expected to be random in one process by observing values produced by another process started from the same snapshot.

The vulnerability exists due to reuse of cached random data in Node.js crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() when their entropy caches are saved into startup snapshots and restored across processes. A remote attacker can observe outputs from another process using the same snapshot to predict repeated values in a target process before its cache is refilled.

8) Improper handling of exceptional conditions (CVE-ID: CVE-2026-106070)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a ZIP scanner to approve content different from the content another ZIP implementation extracts from the same archive.

The vulnerability exists due to improper handling of validation errors in the Node.js zlib.ZipFile API when reading zipEntry.modified directly or during archive compaction. A remote attacker can supply an archive with inconsistent local and central headers and an attacker-selected central directory CRC to leave an invalid local header cached without a content offset, causing subsequent reads to return file-prefix bytes that pass CRC-32 verification instead of the requested entry content.

9) Partial String Comparison (CVE-ID: CVE-2026-106071)

CWE-ID: CWE-187 - Partial String Comparison

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read or write filesystem paths outside the access granted by wildcard Permission Model rules.

The vulnerability exists due to incomplete path-prefix comparison in the Node.js Permission Model radix tree lookup when a requested path is shorter than the prefix of a wildcard grant. A local user can execute code that requests a shorter path to bypass filesystem restrictions; for example, --allow-fs-read=/etc/passwd.* incorrectly permits reading /etc/passwd.

The wildcard grant must sit directly under the root of the permission tree, for example when it is the only grant for that scope.

10) Missing Authorization (CVE-ID: CVE-2026-106073)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose filesystem path information outside directories permitted by the Node.js Permission Model.

The vulnerability exists due to missing read authorization checks in Node.js fs.realpathSync() when code runs under --permission with restricted --allow-fs-read settings. A local user can invoke fs.realpathSync() on paths outside permitted directories to check file existence, resolve symlink targets, and enumerate filesystem paths.

Remediation

Install update from vendor's website.

References

• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases