From 75ecd2076b82449f73bf2cd49d013191873d46d4 Mon Sep 17 00:00:00 2001 From: Create or Update Pull Request Action Date: Fri, 26 Jun 2026 21:24:57 +0000 Subject: [PATCH 1/4] vex: regenerate node.openvex.json --- tools/vex/node.openvex.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/vex/node.openvex.json b/tools/vex/node.openvex.json index 5a107689..4f57d990 100644 --- a/tools/vex/node.openvex.json +++ b/tools/vex/node.openvex.json @@ -1,9 +1,9 @@ { "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://openvex.dev/docs/public/vex-c457698bda4fafafdf6fa823b3db6d2d334d9bb331e0726f290325e2a06722bb", + "@id": "https://openvex.dev/docs/public/vex-c02aa52d0e3084cd74609b06dda0db8afdf2c4c2e03a2da8ef5736c2ee52c28b", "author": "Node.js Security WG", "role": "Project", - "timestamp": "2026-06-26T21:22:10.5365226Z", + "timestamp": "2026-06-26T21:24:56.848199245Z", "version": 1, "statements": [ { From 3d328de6159db3dddcc9300135ac6504aee01368 Mon Sep 17 00:00:00 2001 From: Create or Update Pull Request Action Date: Mon, 20 Jul 2026 20:08:57 +0000 Subject: [PATCH 2/4] vex: regenerate node.openvex.json --- tools/vex/node.openvex.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/vex/node.openvex.json b/tools/vex/node.openvex.json index 4f57d990..a4f27d06 100644 --- a/tools/vex/node.openvex.json +++ b/tools/vex/node.openvex.json @@ -1,9 +1,9 @@ { "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://openvex.dev/docs/public/vex-c02aa52d0e3084cd74609b06dda0db8afdf2c4c2e03a2da8ef5736c2ee52c28b", + "@id": "https://openvex.dev/docs/public/vex-ce2d4ce64c6cfe8ff8cac2d269a4e402bd340759305f47ffb3c727db7a9a7ea0", "author": "Node.js Security WG", "role": "Project", - "timestamp": "2026-06-26T21:24:56.848199245Z", + "timestamp": "2026-07-20T20:08:56.744070368Z", "version": 1, "statements": [ { From 0b925eb187ea452fef12273d3699fabd3782196b Mon Sep 17 00:00:00 2001 From: Create or Update Pull Request Action Date: Tue, 25 Aug 2026 15:41:40 +0000 Subject: [PATCH 3/4] vex: regenerate node.openvex.json --- tools/vex/node.openvex.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/vex/node.openvex.json b/tools/vex/node.openvex.json index a4f27d06..661df541 100644 --- a/tools/vex/node.openvex.json +++ b/tools/vex/node.openvex.json @@ -1,9 +1,9 @@ { "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://openvex.dev/docs/public/vex-ce2d4ce64c6cfe8ff8cac2d269a4e402bd340759305f47ffb3c727db7a9a7ea0", + "@id": "https://openvex.dev/docs/public/vex-d4f5ff2d0489341afc9a141162032004927e7a246103cd987e1036959d94efa5", "author": "Node.js Security WG", "role": "Project", - "timestamp": "2026-07-20T20:08:56.744070368Z", + "timestamp": "2026-08-25T15:41:39.593395734Z", "version": 1, "statements": [ { From 7b7b79c46d1c0228940431a4beae32d1ebd0a1e5 Mon Sep 17 00:00:00 2001 From: Create or Update Pull Request Action Date: Tue, 25 Aug 2026 16:18:43 +0000 Subject: [PATCH 4/4] vex: regenerate node.openvex.json --- tools/vex/node.openvex.json | 207 +++++++++++++++++++++++++++++++++++- 1 file changed, 205 insertions(+), 2 deletions(-) diff --git a/tools/vex/node.openvex.json b/tools/vex/node.openvex.json index 661df541..8e115d7c 100644 --- a/tools/vex/node.openvex.json +++ b/tools/vex/node.openvex.json @@ -1,9 +1,9 @@ { "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://openvex.dev/docs/public/vex-d4f5ff2d0489341afc9a141162032004927e7a246103cd987e1036959d94efa5", + "@id": "https://openvex.dev/docs/public/vex-2ac861941cc20c072a17f4b848fccd0f05b01e992ac2d5dfb02b0124eec07636", "author": "Node.js Security WG", "role": "Project", - "timestamp": "2026-08-25T15:41:39.593395734Z", + "timestamp": "2026-08-25T16:18:42.828286209Z", "version": 1, "statements": [ { @@ -3504,6 +3504,209 @@ } ], "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-56846", + "name": "CVE-2026-56846", + "description": "A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.\n\nThis vulnerability affects Node.js **24.x** and **22.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.18.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-56847", + "name": "CVE-2026-56847", + "description": "A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v26.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-56848", + "name": "CVE-2026-56848", + "description": "A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v26.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-56850", + "name": "CVE-2026-56850", + "description": "A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v26.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58039", + "name": "CVE-2026-58039", + "description": "A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v26.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58040", + "name": "CVE-2026-58040", + "description": "An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v26.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58041", + "name": "CVE-2026-58041", + "description": "A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v24.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v26.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58042", + "name": "CVE-2026-58042", + "description": "A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.\n\nRepeated triggering of this condition can lead to denial of service.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v26.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58043", + "name": "CVE-2026-58043", + "description": "A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\n\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\n\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v26.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58044", + "name": "CVE-2026-58044", + "description": "A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\n\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v26.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58045", + "name": "CVE-2026-58045", + "description": "A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected.\n\nRepeated exploitation of this condition can result in a denial of service.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v26.5.1" + } + ], + "status": "fixed" } ] }