From 6a915e1a60cf478ed00975b76dee657f08b8f555 Mon Sep 17 00:00:00 2001
From: "Node.js GitHub Bot" <github-bot@iojs.org>
Date: Thu, 22 Oct 2026 13:46:40 +0000
Subject: [PATCH] Sync security vulnerabilities

---
 vuln/core/195.json | 14 ++++++++++++++
 vuln/core/196.json | 14 ++++++++++++++
 vuln/core/197.json | 14 ++++++++++++++
 vuln/core/198.json | 14 ++++++++++++++
 vuln/core/199.json | 14 ++++++++++++++
 vuln/core/200.json | 14 ++++++++++++++
 vuln/core/201.json | 14 ++++++++++++++
 vuln/core/202.json | 14 ++++++++++++++
 vuln/core/203.json | 14 ++++++++++++++
 vuln/core/204.json | 14 ++++++++++++++
 10 files changed, 140 insertions(+)
 create mode 100644 vuln/core/195.json
 create mode 100644 vuln/core/196.json
 create mode 100644 vuln/core/197.json
 create mode 100644 vuln/core/198.json
 create mode 100644 vuln/core/199.json
 create mode 100644 vuln/core/200.json
 create mode 100644 vuln/core/201.json
 create mode 100644 vuln/core/202.json
 create mode 100644 vuln/core/203.json
 create mode 100644 vuln/core/204.json

diff --git a/vuln/core/195.json b/vuln/core/195.json
new file mode 100644
index 00000000..8ab28942
--- /dev/null
+++ b/vuln/core/195.json
@@ -0,0 +1,14 @@
+{
+  "cve": [
+    "CVE-2026-105481"
+  ],
+  "vulnerable": "22.x || 24.x || 26.x",
+  "patched": "^22.23.4 || ^24.22.1 || ^26.12.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
+  "description": "Keep-alive socket process a response that was written before the request was sent",
+  "overview": "This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",
+  "affectedEnvironments": [
+    "all"
+  ],
+  "severity": "medium"
+}
diff --git a/vuln/core/196.json b/vuln/core/196.json
new file mode 100644
index 00000000..34c9ed1f
--- /dev/null
+++ b/vuln/core/196.json
@@ -0,0 +1,14 @@
+{
+  "cve": [
+    "CVE-2026-105482"
+  ],
+  "vulnerable": "22.x || 24.x || 26.x",
+  "patched": "^22.23.4 || ^24.22.1 || ^26.12.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
+  "description": "dns.resolve truncates names containing NUL char",
+  "overview": "This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",
+  "affectedEnvironments": [
+    "all"
+  ],
+  "severity": "high"
+}
diff --git a/vuln/core/197.json b/vuln/core/197.json
new file mode 100644
index 00000000..55ee8528
--- /dev/null
+++ b/vuln/core/197.json
@@ -0,0 +1,14 @@
+{
+  "cve": [
+    "CVE-2026-105483"
+  ],
+  "vulnerable": "24.x || 26.x",
+  "patched": "^24.22.1 || ^26.12.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
+  "description": "TLS certificate hostname bypass when the IP is written fullwidth digits",
+  "overview": "This vulnerability affects Node.js **26.x** and **24.x**.",
+  "affectedEnvironments": [
+    "all"
+  ],
+  "severity": "high"
+}
diff --git a/vuln/core/198.json b/vuln/core/198.json
new file mode 100644
index 00000000..73ce13dc
--- /dev/null
+++ b/vuln/core/198.json
@@ -0,0 +1,14 @@
+{
+  "cve": [
+    "CVE-2026-106069"
+  ],
+  "vulnerable": "22.x || 24.x || 26.x",
+  "patched": "^22.23.4 || ^24.22.1 || ^26.12.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
+  "description": "TLS certificate hostname bypass when the host loosely resolves to an IP address",
+  "overview": "This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",
+  "affectedEnvironments": [
+    "all"
+  ],
+  "severity": "high"
+}
diff --git a/vuln/core/199.json b/vuln/core/199.json
new file mode 100644
index 00000000..9bf70aff
--- /dev/null
+++ b/vuln/core/199.json
@@ -0,0 +1,14 @@
+{
+  "cve": [
+    "CVE-2026-106070"
+  ],
+  "vulnerable": "26.x",
+  "patched": "^26.12.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
+  "description": "Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation",
+  "overview": "This vulnerability affects Node.js **26.x**.",
+  "affectedEnvironments": [
+    "all"
+  ],
+  "severity": "low"
+}
diff --git a/vuln/core/200.json b/vuln/core/200.json
new file mode 100644
index 00000000..c37254d2
--- /dev/null
+++ b/vuln/core/200.json
@@ -0,0 +1,14 @@
+{
+  "cve": [
+    "CVE-2026-106071"
+  ],
+  "vulnerable": "26.x",
+  "patched": "^26.12.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
+  "description": "Permission Model filesystem over-grant via wildcard radix lookup",
+  "overview": "This vulnerability affects Node.js **26.x**.",
+  "affectedEnvironments": [
+    "all"
+  ],
+  "severity": "low"
+}
diff --git a/vuln/core/201.json b/vuln/core/201.json
new file mode 100644
index 00000000..1c7b3a0b
--- /dev/null
+++ b/vuln/core/201.json
@@ -0,0 +1,14 @@
+{
+  "cve": [
+    "CVE-2026-106072"
+  ],
+  "vulnerable": "22.x || 24.x || 26.x",
+  "patched": "^22.23.4 || ^24.22.1 || ^26.12.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
+  "description": "Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints",
+  "overview": "This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",
+  "affectedEnvironments": [
+    "all"
+  ],
+  "severity": "medium"
+}
diff --git a/vuln/core/202.json b/vuln/core/202.json
new file mode 100644
index 00000000..a6b02ead
--- /dev/null
+++ b/vuln/core/202.json
@@ -0,0 +1,14 @@
+{
+  "cve": [
+    "CVE-2026-106073"
+  ],
+  "vulnerable": "22.x || 24.x || 26.x",
+  "patched": "^22.23.4 || ^24.22.1 || ^26.12.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
+  "description": "Permission Model bypass with fs.realpathSync",
+  "overview": "This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",
+  "affectedEnvironments": [
+    "all"
+  ],
+  "severity": "low"
+}
diff --git a/vuln/core/203.json b/vuln/core/203.json
new file mode 100644
index 00000000..b8aad663
--- /dev/null
+++ b/vuln/core/203.json
@@ -0,0 +1,14 @@
+{
+  "cve": [
+    "CVE-2026-106074"
+  ],
+  "vulnerable": "22.x || 24.x || 26.x",
+  "patched": "^22.23.4 || ^24.22.1 || ^26.12.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
+  "description": "crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values",
+  "overview": "This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",
+  "affectedEnvironments": [
+    "all"
+  ],
+  "severity": "medium"
+}
diff --git a/vuln/core/204.json b/vuln/core/204.json
new file mode 100644
index 00000000..a8b6bf6e
--- /dev/null
+++ b/vuln/core/204.json
@@ -0,0 +1,14 @@
+{
+  "cve": [
+    "CVE-2026-111497"
+  ],
+  "vulnerable": "22.x || 24.x || 26.x",
+  "patched": "^22.23.4 || ^24.22.1 || ^26.12.1",
+  "ref": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
+  "description": "Node.js Brotli decoder out-of-bounds write permits remote code execution",
+  "overview": "A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",
+  "affectedEnvironments": [
+    "all"
+  ],
+  "severity": "high"
+}