{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-56846: http2: retain header memory in session accounting --\n HandleHeadersFrame() un-charged the decoded header block from\n maxSessionMemory as soon as it handed it to JS, even though the JS objects\n can keep the block alive for the whole lifetime of the stream, so a peer\n that opens many streams with large header blocks and never lets them\n complete keeps unbounded header memory alive while the credit-based limit\n reads as near zero and never rejects a new stream. The amount is now moved\n into a new per-stream counter, Http2Stream::retained_headers_length_, and\n RemoveStream() drains both counters when the stream is erased (backport of\n nodejs/node@f14d78b9, the v22.x release-line commit shipped in v22.23.2,\n carrying the upstream regression test with two deviations. The header block\n is built as an object with a multi-valued cookie field because 14.21.3's\n Http2Session#request() rejects the flat array upstream passes; that one is\n required, or the test throws ERR_INVALID_ARG_TYPE before it ever reaches\n the fix. The server also raises maxHeaderListPairs to 4096, which is\n hardening: it puts the pair-count branch of AddHeader() structurally out of\n reach, leaving the session-memory branch as the only thing the test can be\n measuring. The wire shape still matches upstream's -- 120 cookie fields\n plus four pseudo-headers, 124 entries. The three doc/api/http2.md hunks are\n deliberately omitted, so the -docs sub-package keeps describing\n maxSessionMemory without the \"header blocks retained by open streams\"\n clause)\n- CVE-2026-56848: http2: defer rst stream while in scope --\n SubmitRstStream() force-purged pending session data via SendPendingData()\n for every error code except NGHTTP2_CANCEL, so a RST_STREAM submitted for\n a refused stream from inside an nghttp2 receive callback re-entered\n nghttp2_session_mem_send() while nghttp2_session_mem_recv() was still on\n the stack, and the send path could free streams the active receive was\n still using (heap use-after-free, reachable by sending GOAWAY with\n last_stream_id 0 immediately followed by HEADERS for further streams).\n NGHTTP2_REFUSED_STREAM now takes the same deferred path, flushing the\n RST_STREAM and leaving the pending data for the enclosing Http2Scope\n (backport of nodejs/node@daa6d25e, the v22.x release-line commit shipped\n in v22.23.2, carrying the upstream regression test verbatim; the cosmetic\n re-indent of the pre-existing AddPendingRstStream block is not carried)", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1788873015", "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1788873015" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_nodejs/el6/advisories/2026/clsa-2026_1788873015.json" } ], "tracking": { "current_release_date": "2026-09-08T13:10:58Z", "generator": { "date": "2026-09-08T13:10:58Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1788873015", "initial_release_date": "2026-09-08T13:10:58Z", "revision_history": [ { "date": "2026-09-08T13:10:58Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "alt-nodejs14-nodejs: Fix of 2 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 6", "product": { "name": "Community Enterprise Operating System 6", "product_id": "CentOS-6", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-nodejs14-nodejs-devel-0:14.21.3-34.el6.x86_64", "product": { "name": "alt-nodejs14-nodejs-devel-0:14.21.3-34.el6.x86_64", "product_id": "alt-nodejs14-nodejs-devel-0:14.21.3-34.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-nodejs-devel@14.21.3-34.el6?arch=x86_64&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-nodejs14-npm-1:6.14.18-14.21.3.34.el6.x86_64", "product": { "name": "alt-nodejs14-npm-1:6.14.18-14.21.3.34.el6.x86_64", "product_id": "alt-nodejs14-npm-1:6.14.18-14.21.3.34.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-npm@6.14.18-14.21.3.34.el6?arch=x86_64&epoch=1&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-nodejs14-nodejs-0:14.21.3-34.el6.x86_64", "product": { "name": "alt-nodejs14-nodejs-0:14.21.3-34.el6.x86_64", "product_id": "alt-nodejs14-nodejs-0:14.21.3-34.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-nodejs@14.21.3-34.el6?arch=x86_64&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-nodejs14-npm-1:6.14.18-14.21.3.32.el6.x86_64", "product": { "name": "alt-nodejs14-npm-1:6.14.18-14.21.3.32.el6.x86_64", "product_id": "alt-nodejs14-npm-1:6.14.18-14.21.3.32.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-npm@6.14.18-14.21.3.32.el6?arch=x86_64&epoch=1&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-nodejs14-nodejs-0:14.21.3-32.el6.x86_64", "product": { "name": "alt-nodejs14-nodejs-0:14.21.3-32.el6.x86_64", "product_id": "alt-nodejs14-nodejs-0:14.21.3-32.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-nodejs@14.21.3-32.el6?arch=x86_64&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-nodejs14-nodejs-devel-0:14.21.3-32.el6.x86_64", "product": { "name": "alt-nodejs14-nodejs-devel-0:14.21.3-32.el6.x86_64", "product_id": "alt-nodejs14-nodejs-devel-0:14.21.3-32.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-nodejs-devel@14.21.3-32.el6?arch=x86_64&os_name=centos&os_version=6" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "alt-nodejs14-nodejs-docs-0:14.21.3-34.el6.noarch", "product": { "name": "alt-nodejs14-nodejs-docs-0:14.21.3-34.el6.noarch", "product_id": "alt-nodejs14-nodejs-docs-0:14.21.3-34.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-nodejs-docs@14.21.3-34.el6?arch=noarch&os_name=centos&os_version=6" } } }, { "category": "product_version", "name": "alt-nodejs14-nodejs-docs-0:14.21.3-32.el6.noarch", "product": { "name": "alt-nodejs14-nodejs-docs-0:14.21.3-32.el6.noarch", "product_id": "alt-nodejs14-nodejs-docs-0:14.21.3-32.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-nodejs14-nodejs-docs@14.21.3-32.el6?arch=noarch&os_name=centos&os_version=6" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-nodejs-devel-0:14.21.3-34.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-nodejs14-nodejs-devel-0:14.21.3-34.el6.x86_64" }, "product_reference": "alt-nodejs14-nodejs-devel-0:14.21.3-34.el6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-nodejs-docs-0:14.21.3-34.el6.noarch as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-nodejs14-nodejs-docs-0:14.21.3-34.el6.noarch" }, "product_reference": "alt-nodejs14-nodejs-docs-0:14.21.3-34.el6.noarch", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-npm-1:6.14.18-14.21.3.34.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-nodejs14-npm-1:6.14.18-14.21.3.34.el6.x86_64" }, "product_reference": "alt-nodejs14-npm-1:6.14.18-14.21.3.34.el6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-nodejs-0:14.21.3-34.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-nodejs14-nodejs-0:14.21.3-34.el6.x86_64" }, "product_reference": "alt-nodejs14-nodejs-0:14.21.3-34.el6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-nodejs-docs-0:14.21.3-32.el6.noarch as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-nodejs14-nodejs-docs-0:14.21.3-32.el6.noarch" }, "product_reference": "alt-nodejs14-nodejs-docs-0:14.21.3-32.el6.noarch", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-npm-1:6.14.18-14.21.3.32.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-nodejs14-npm-1:6.14.18-14.21.3.32.el6.x86_64" }, "product_reference": "alt-nodejs14-npm-1:6.14.18-14.21.3.32.el6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-nodejs-0:14.21.3-32.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-nodejs14-nodejs-0:14.21.3-32.el6.x86_64" }, "product_reference": "alt-nodejs14-nodejs-0:14.21.3-32.el6.x86_64", "relates_to_product_reference": "CentOS-6" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-nodejs-devel-0:14.21.3-32.el6.x86_64 as a component of Community Enterprise Operating System 6", "product_id": "CentOS-6:alt-nodejs14-nodejs-devel-0:14.21.3-32.el6.x86_64" }, "product_reference": "alt-nodejs14-nodejs-devel-0:14.21.3-32.el6.x86_64", "relates_to_product_reference": "CentOS-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-56846", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.\r\n\r\nThis vulnerability affects Node.js **24.x** and **22.x**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-nodejs14-nodejs-0:14.21.3-34.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-devel-0:14.21.3-34.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-docs-0:14.21.3-34.el6.noarch", "CentOS-6:alt-nodejs14-npm-1:6.14.18-14.21.3.34.el6.x86_64" ], "known_affected": [ "CentOS-6:alt-nodejs14-nodejs-0:14.21.3-32.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-devel-0:14.21.3-32.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-docs-0:14.21.3-32.el6.noarch", "CentOS-6:alt-nodejs14-npm-1:6.14.18-14.21.3.32.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-56846" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases" } ], "release_date": "2026-08-04T01:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-08T13:10:17.940458Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1788873015", "product_ids": [ "CentOS-6:alt-nodejs14-nodejs-0:14.21.3-34.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-devel-0:14.21.3-34.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-docs-0:14.21.3-34.el6.noarch", "CentOS-6:alt-nodejs14-npm-1:6.14.18-14.21.3.34.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1788873015" }, { "category": "none_available", "date": "2026-08-04T01:16:00Z", "details": "Affected", "product_ids": [ "CentOS-6:alt-nodejs14-nodejs-0:14.21.3-32.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-devel-0:14.21.3-32.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-docs-0:14.21.3-32.el6.noarch", "CentOS-6:alt-nodejs14-npm-1:6.14.18-14.21.3.32.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-56848", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.\r\n\r\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-6:alt-nodejs14-nodejs-0:14.21.3-34.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-devel-0:14.21.3-34.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-docs-0:14.21.3-34.el6.noarch", "CentOS-6:alt-nodejs14-npm-1:6.14.18-14.21.3.34.el6.x86_64" ], "known_affected": [ "CentOS-6:alt-nodejs14-nodejs-0:14.21.3-32.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-devel-0:14.21.3-32.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-docs-0:14.21.3-32.el6.noarch", "CentOS-6:alt-nodejs14-npm-1:6.14.18-14.21.3.32.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-nodejs/cve/CVE-2026-56848" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases", "url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases" } ], "release_date": "2026-08-04T17:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-09-08T13:10:17.940458Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1788873015", "product_ids": [ "CentOS-6:alt-nodejs14-nodejs-0:14.21.3-34.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-devel-0:14.21.3-34.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-docs-0:14.21.3-34.el6.noarch", "CentOS-6:alt-nodejs14-npm-1:6.14.18-14.21.3.34.el6.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-nodejs/releases/CLSA-2026:1788873015" }, { "category": "none_available", "date": "2026-08-04T17:16:00Z", "details": "Affected", "product_ids": [ "CentOS-6:alt-nodejs14-nodejs-0:14.21.3-32.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-devel-0:14.21.3-32.el6.x86_64", "CentOS-6:alt-nodejs14-nodejs-docs-0:14.21.3-32.el6.noarch", "CentOS-6:alt-nodejs14-npm-1:6.14.18-14.21.3.32.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }