diff --git a/tools/vex/node.openvex.json b/tools/vex/node.openvex.json index 453bce44..9c24c213 100644 --- a/tools/vex/node.openvex.json +++ b/tools/vex/node.openvex.json @@ -1,9 +1,9 @@ { "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://openvex.dev/docs/public/vex-622ad9ca84eaf6f5ee9def153b7ac218f3848d024379cab20c6eb2c0e4330cbb", + "@id": "https://openvex.dev/docs/public/vex-199ed03f61ef02efec4be3c8f2d32d52ed32599e7860706fc48f2b0adc5da5b1", "author": "Node.js Security WG", "role": "Project", - "timestamp": "2026-10-22T13:58:50.905060589Z", + "timestamp": "2026-10-22T14:10:01.920919932Z", "version": 1, "statements": [ { @@ -3689,209 +3689,6 @@ ], "status": "fixed" }, - { - "vulnerability": { - "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58045", - "name": "CVE-2026-58045", - "description": "A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected.\n\nRepeated exploitation of this condition can result in a denial of service.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**." - }, - "products": [ - { - "@id": "pkg:generic/nodejs/node@v22.23.2" - }, - { - "@id": "pkg:generic/nodejs/node@v24.18.1" - }, - { - "@id": "pkg:generic/nodejs/node@v26.5.1" - } - ], - "status": "fixed" - }, - { - "vulnerability": { - "@id": "https://www.cve.org/CVERecord?id=CVE-2026-56846", - "name": "CVE-2026-56846", - "description": "A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.\n\nThis vulnerability affects Node.js **24.x** and **22.x**." - }, - "products": [ - { - "@id": "pkg:generic/nodejs/node@v22.23.2" - }, - { - "@id": "pkg:generic/nodejs/node@v24.18.1" - } - ], - "status": "fixed" - }, - { - "vulnerability": { - "@id": "https://www.cve.org/CVERecord?id=CVE-2026-56847", - "name": "CVE-2026-56847", - "description": "A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**." - }, - "products": [ - { - "@id": "pkg:generic/nodejs/node@v22.23.2" - }, - { - "@id": "pkg:generic/nodejs/node@v24.18.1" - }, - { - "@id": "pkg:generic/nodejs/node@v26.5.1" - } - ], - "status": "fixed" - }, - { - "vulnerability": { - "@id": "https://www.cve.org/CVERecord?id=CVE-2026-56848", - "name": "CVE-2026-56848", - "description": "A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**." - }, - "products": [ - { - "@id": "pkg:generic/nodejs/node@v22.23.2" - }, - { - "@id": "pkg:generic/nodejs/node@v24.18.1" - }, - { - "@id": "pkg:generic/nodejs/node@v26.5.1" - } - ], - "status": "fixed" - }, - { - "vulnerability": { - "@id": "https://www.cve.org/CVERecord?id=CVE-2026-56850", - "name": "CVE-2026-56850", - "description": "A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**." - }, - "products": [ - { - "@id": "pkg:generic/nodejs/node@v22.23.2" - }, - { - "@id": "pkg:generic/nodejs/node@v24.18.1" - }, - { - "@id": "pkg:generic/nodejs/node@v26.5.1" - } - ], - "status": "fixed" - }, - { - "vulnerability": { - "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58039", - "name": "CVE-2026-58039", - "description": "A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**." - }, - "products": [ - { - "@id": "pkg:generic/nodejs/node@v22.23.2" - }, - { - "@id": "pkg:generic/nodejs/node@v24.18.1" - }, - { - "@id": "pkg:generic/nodejs/node@v26.5.1" - } - ], - "status": "fixed" - }, - { - "vulnerability": { - "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58040", - "name": "CVE-2026-58040", - "description": "An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**." - }, - "products": [ - { - "@id": "pkg:generic/nodejs/node@v22.23.2" - }, - { - "@id": "pkg:generic/nodejs/node@v24.18.1" - }, - { - "@id": "pkg:generic/nodejs/node@v26.5.1" - } - ], - "status": "fixed" - }, - { - "vulnerability": { - "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58041", - "name": "CVE-2026-58041", - "description": "A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**." - }, - "products": [ - { - "@id": "pkg:generic/nodejs/node@v24.18.1" - }, - { - "@id": "pkg:generic/nodejs/node@v26.5.1" - } - ], - "status": "fixed" - }, - { - "vulnerability": { - "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58042", - "name": "CVE-2026-58042", - "description": "A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.\n\nRepeated triggering of this condition can lead to denial of service.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**." - }, - "products": [ - { - "@id": "pkg:generic/nodejs/node@v22.23.2" - }, - { - "@id": "pkg:generic/nodejs/node@v24.18.1" - }, - { - "@id": "pkg:generic/nodejs/node@v26.5.1" - } - ], - "status": "fixed" - }, - { - "vulnerability": { - "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58043", - "name": "CVE-2026-58043", - "description": "A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.\n\nUnder `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.\n\nThis vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**." - }, - "products": [ - { - "@id": "pkg:generic/nodejs/node@v22.23.2" - }, - { - "@id": "pkg:generic/nodejs/node@v24.18.1" - }, - { - "@id": "pkg:generic/nodejs/node@v26.5.1" - } - ], - "status": "fixed" - }, - { - "vulnerability": { - "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58044", - "name": "CVE-2026-58044", - "description": "A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection.\n\nNode.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**." - }, - "products": [ - { - "@id": "pkg:generic/nodejs/node@v22.23.2" - }, - { - "@id": "pkg:generic/nodejs/node@v24.18.1" - }, - { - "@id": "pkg:generic/nodejs/node@v26.5.1" - } - ], - "status": "fixed" - }, { "vulnerability": { "@id": "https://www.cve.org/CVERecord?id=CVE-2026-58045",