SB2026102726 - Anolis OS update for nodejs
Published: October 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 vulnerabilities.
1) Race condition (CVE-ID: CVE-2026-105481)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause an HTTP client to accept an unsolicited response as the response to a subsequent request.
The vulnerability exists due to a timing-dependent gap in unexpected-data checks in Node.js HTTP Agent connection reuse when an idle keep-alive socket is assigned to a new request before pending data has been read. A remote attacker can send an unsolicited response over the idle connection before the next request is sent to have that response parsed as valid data for the new request.
2) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-48931)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to poison the HTTP response queue.
The vulnerability exists due to a time-of-check time-of-use race condition in http.Agent when accepting a response before the client has sent the request. A remote attacker can send a response early to poison the HTTP response queue.
3) Improper Neutralization of Null Byte or NUL Character (CVE-ID: CVE-2026-105482)
CWE-ID: CWE-158 - Improper Neutralization of Null Byte or NUL Character
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass hostname-based validation and cause an application to use DNS records for a different domain.
The vulnerability exists due to improper handling of embedded null bytes in Node.js dns.resolve*() and dns.reverse() when passing hostnames to c-ares as C strings. A remote attacker can supply a hostname such as attacker.example .trusted.example to an application that validates the full hostname before resolution, causing the resolver to query attacker.example instead and potentially bypass domain allowlist restrictions.
4) Improper Null Termination (CVE-ID: CVE-2026-48930)
CWE-ID: CWE-170 - Improper Null Termination
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass hostname-based authority checks.
The vulnerability exists due to c-string truncation in resolver bindings in TLS hostname handling when processing hostnames containing an embedded nul character. A remote attacker can present a crafted hostname to bypass hostname-based authority checks.
5) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-105483)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass TLS endpoint identity verification using a certificate without a matching IP address subject alternative name.
The vulnerability exists due to improper certificate hostname validation in Node.js tls.checkServerIdentity() when an IPv4 host is written with non-ASCII characters, such as １２７.0.0.1. A remote attacker can present a certificate containing DNS:127.0.0.1 or DNS:*.0.0.1 to have the endpoint accepted through DNS-name or Common Name matching instead of the required IP address verification.
6) Input validation error (CVE-ID: CVE-2026-48618)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass tls wildcard-depth authentication.
The vulnerability exists due to improper input validation in TLS hostname handling when normalizing hostnames with unicode dot separators. A remote attacker can present a crafted hostname to bypass tls wildcard-depth authentication.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
7) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-106069)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to authenticate a TLS server using a certificate issued for a different IP address.
The vulnerability exists due to inconsistent IP address interpretation in Node.js tls.checkServerIdentity() and the operating system resolver when connecting to a non-canonical IPv4 literal with a leading zero. A remote attacker can serve a certificate for 87.0.0.1 at the connected address 127.0.0.1 when the client uses 0127.0.0.1, exploiting octal interpretation during certificate validation and decimal interpretation during connection establishment to bypass endpoint identity verification.
Exploitation depends on resolver behavior that interprets the leading-zero octet as decimal, as described for platforms such as macOS.
8) Partial String Comparison (CVE-ID: CVE-2026-106071)
CWE-ID: CWE-187 - Partial String Comparison
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read or write filesystem paths outside the access granted by wildcard Permission Model rules.
The vulnerability exists due to incomplete path-prefix comparison in the Node.js Permission Model radix tree lookup when a requested path is shorter than the prefix of a wildcard grant. A local user can execute code that requests a shorter path to bypass filesystem restrictions; for example, --allow-fs-read=/etc/passwd.* incorrectly permits reading /etc/passwd.
The wildcard grant must sit directly under the root of the permission tree, for example when it is the only grant for that scope.
9) Improper access control (CVE-ID: CVE-2026-58043)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read from or write to paths outside the intended filesystem allowlist.
The vulnerability exists due to improper access control in Node.js Permission Model path matching when handling radix-tree prefix boundaries under --permission. A local user can abuse prefix boundary handling to read from or write to paths outside the intended filesystem allowlist.
The issue applies only when the Permission Model is enabled with --permission.
10) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-106072)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass TLS endpoint identity verification using a certificate with a numeric DNS subject alternative name but no matching IP address subject alternative name.
The vulnerability exists due to improper certificate hostname validation in Node.js tls.checkServerIdentity() when non-canonical IPv4 literals are normalized but not classified as IP addresses. A remote attacker can present a certificate containing DNS:127.0.0.1 without IP Address:127.0.0.1 when a client connects using 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1 to have the certificate incorrectly accepted for the IP endpoint.
Exploitation requires a certificate issued by a CA trusted by the client and a platform resolver that accepts these non-canonical spellings, such as glibc.
11) Missing Authorization (CVE-ID: CVE-2026-106073)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose filesystem path information outside directories permitted by the Node.js Permission Model.
The vulnerability exists due to missing read authorization checks in Node.js fs.realpathSync() when code runs under --permission with restricted --allow-fs-read settings. A local user can invoke fs.realpathSync() on paths outside permitted directories to check file existence, resolve symlink targets, and enumerate filesystem paths.
12) Improper Access Control (CVE-ID: CVE-2026-21715)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose file existence and resolve symlinks.
The vulnerability exists due to improper access control in fs.realpathSync.native() within the Node.js Permission Model when accessing filesystem paths. A local user can run code under --permission with restricted --allow-fs-read to use fs.realpathSync.native() and determine file existence, resolve symlink targets, and enumerate paths outside permitted directories.
This bypass affects only environments using the Permission Model with intentionally restricted filesystem read permissions.
13) Use of insufficiently random values (CVE-ID: CVE-2026-106074)
CWE-ID: CWE-330 - Use of Insufficiently Random Values
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to predict values expected to be random in one process by observing values produced by another process started from the same snapshot.
The vulnerability exists due to reuse of cached random data in Node.js crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() when their entropy caches are saved into startup snapshots and restored across processes. A remote attacker can observe outputs from another process using the same snapshot to predict repeated values in a target process before its cache is refilled.
14) Out-of-bounds write (CVE-ID: CVE-2026-111497)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt process memory, potentially execute arbitrary code, disclose process memory, or cause a denial of service.
The vulnerability exists due to an out-of-bounds write in the Brotli decoder bundled with Node.js when an invalid block switch is treated as a temporary need for input rather than a permanent format error. A remote attacker can supply malformed Brotli data that an application decompresses with node:zlib to make the streaming decoder append bytes beyond an eight-byte internal buffer, potentially causing code execution, process memory disclosure, or a crash.
Remediation
Install update from vendor's website.