Skip to content

regenerate node.openvex.json #1574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
github-actions wants to merge 4 commits into
base: main
Choose a base branch
from
Open

regenerate node.openvex.json #1574

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
75ecd20
vex: regenerate node.openvex.json
create-or-update-pull-request Jun 26, 2026
3d328de
vex: regenerate node.openvex.json
create-or-update-pull-request Jul 20, 2026
0b925eb
vex: regenerate node.openvex.json
create-or-update-pull-request Aug 25, 2026
7b7b79c
vex: regenerate node.openvex.json
create-or-update-pull-request Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
207 changes: 205 additions & 2 deletions tools/vex/node.openvex.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
{
"@context": "https://openvex.dev/ns/v0.2.0",
"@id": "https://openvex.dev/docs/public/vex-c457698bda4fafafdf6fa823b3db6d2d334d9bb331e0726f290325e2a06722bb",
"@id": "https://openvex.dev/docs/public/vex-2ac861941cc20c072a17f4b848fccd0f05b01e992ac2d5dfb02b0124eec07636",
"author": "Node.js Security WG",
"role": "Project",
"timestamp": "2026-06-26T21:22:10.5365226Z",
"timestamp": "2026-08-25T16:18:42.828286209Z",
"version": 1,
"statements": [
{
Expand Down Expand Up @@ -3504,6 +3504,209 @@
}
],
"status": "fixed"
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-56846",
"name": "CVE-2026-56846",
"description": "A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.\n\nThis vulnerability affects Node.js **24.x** and **22.x**."
},
"products": [
{
"@id": "pkg:generic/nodejs/node@v22.23.2"
},
{
"@id": "pkg:generic/nodejs/node@v24.18.1"
}
],
"status": "fixed"
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-56847",
"name": "CVE-2026-56847",
"description": "A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."
},
"products": [
{
"@id": "pkg:generic/nodejs/node@v22.23.2"
},
{
"@id": "pkg:generic/nodejs/node@v24.18.1"
},
{
"@id": "pkg:generic/nodejs/node@v26.5.1"
}
],
"status": "fixed"
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-56848",
"name": "CVE-2026-56848",
"description": "A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."
},
"products": [
{
"@id": "pkg:generic/nodejs/node@v22.23.2"
},
{
"@id": "pkg:generic/nodejs/node@v24.18.1"
},
{
"@id": "pkg:generic/nodejs/node@v26.5.1"
}
],
"status": "fixed"
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-56850",
"name": "CVE-2026-56850",
"description": "A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."
},
"products": [
{
"@id": "pkg:generic/nodejs/node@v22.23.2"
},
{
"@id": "pkg:generic/nodejs/node@v24.18.1"
},
{
"@id": "pkg:generic/nodejs/node@v26.5.1"
}
],
"status": "fixed"
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-58039",
"name": "CVE-2026-58039",
"description": "A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."
},
"products": [
{
"@id": "pkg:generic/nodejs/node@v22.23.2"
},
{
"@id": "pkg:generic/nodejs/node@v24.18.1"
},
{
"@id": "pkg:generic/nodejs/node@v26.5.1"
}
],
"status": "fixed"
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-58040",
"name": "CVE-2026-58040",
"description": "An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."
},
"products": [
{
"@id": "pkg:generic/nodejs/node@v22.23.2"
},
{
"@id": "pkg:generic/nodejs/node@v24.18.1"
},
{
"@id": "pkg:generic/nodejs/node@v26.5.1"
}
],
"status": "fixed"
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-58041",
"name": "CVE-2026-58041",
"description": "A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."
},
"products": [
{
"@id": "pkg:generic/nodejs/node@v24.18.1"
},
{
"@id": "pkg:generic/nodejs/node@v26.5.1"
}
],
"status": "fixed"
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-58042",
"name": "CVE-2026-58042",
"description": "A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.\n\nRepeated triggering of this condition can lead to denial of service.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."
},
"products": [
{
"@id": "pkg:generic/nodejs/node@v22.23.2"
},
{
"@id": "pkg:generic/nodejs/node@v24.18.1"
},
{
"@id": "pkg:generic/nodejs/node@v26.5.1"
}
],
"status": "fixed"
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-58043",
"name": "CVE-2026-58043",
"description": "A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\n\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\n\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**."
},
"products": [
{
"@id": "pkg:generic/nodejs/node@v22.23.2"
},
{
"@id": "pkg:generic/nodejs/node@v24.18.1"
},
{
"@id": "pkg:generic/nodejs/node@v26.5.1"
}
],
"status": "fixed"
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-58044",
"name": "CVE-2026-58044",
"description": "A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\n\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."
},
"products": [
{
"@id": "pkg:generic/nodejs/node@v22.23.2"
},
{
"@id": "pkg:generic/nodejs/node@v24.18.1"
},
{
"@id": "pkg:generic/nodejs/node@v26.5.1"
}
],
"status": "fixed"
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-58045",
"name": "CVE-2026-58045",
"description": "A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected.\n\nRepeated exploitation of this condition can result in a denial of service.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."
},
"products": [
{
"@id": "pkg:generic/nodejs/node@v22.23.2"
},
{
"@id": "pkg:generic/nodejs/node@v24.18.1"
},
{
"@id": "pkg:generic/nodejs/node@v26.5.1"
}
],
"status": "fixed"
}
]
}