Tuxcare Errata System 0.0.1 5.10 2026-09-10T15:28:08 Debian 10 * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability - debian/patches/CVE-2025-23166.patch: fix incorrect ThrowException() call in background thread to prevent process crash - CVE-2025-23166 Important TuxCare License Agreement CVE-2025-23166 Debian 10 * SECURITY UPDATE: Node.js cryptographic vulnerability - debian/patches/CVE-2023-30590.patch: update documentation and add tests clarifying DH generateKeys behavior - CVE-2023-30590 Critical TuxCare License Agreement CVE-2025-23085 CVE-2023-30590 CVE-2024-25629 CVE-2024-28863 CVE-2024-27983 CVE-2023-32002 CVE-2023-32006 CVE-2024-22019 Debian 10 * SECURITY UPDATE: HTTP Request Smuggling vulnerability via empty headers separated by CR - debian/patches/CVE-2023-30589.patch: fix llhttp parser to properly validate LF after CR in HTTP header fields, add lenient flag checks before allowing CR without LF, add test file to verify the fix prevents request smuggling attacks - CVE-2023-30589 Important TuxCare License Agreement CVE-2023-30589 CVE-2023-32559 Debian 10 * SECURITY UPDATE: Node.js policy integrity check bypass vulnerability - debian/patches/CVE-2023-38552.patch: use tamper-proof integrity check to prevent forged checksums and tampering with Hash class internals in the policy mechanism - CVE-2023-38552 Important TuxCare License Agreement CVE-2024-27983 CVE-2024-25629 CVE-2024-28863 CVE-2025-23085 CVE-2025-23166 CVE-2024-22019 CVE-2023-38552 Debian 10 * update version, add patches and logs for debian * SECURITY UPDATE: Node.js vulnerabilities - debian/patches/CVE-2023-30589.patch: fix llhttp parser to properly validate LF after CR in HTTP header fields, add lenient flag checks before allowing CR without LF, add test file to verify the fix prevents request smuggling attacks - CVE-2023-30589 - debian/patches/CVE-2023-32559.patch: disable process.binding() when policy is enabled; update deprecations and errors docs and add new tests ensuring denial behavior - CVE-2023-32559 - debian/patches/CVE-2023-30590.patch: update documentation and add tests clarifying DH generateKeys behavior - CVE-2023-30590 - debian/patches/CVE-2023-23918.patch: prevent process.mainModule.require() policy bypass - CVE-2023-23918 - debian/patches/CVE-2023-32002-32006.patch: fix policy bypass vulnerabilities in experimental policy mechanism: * CVE-2023-32002: prevent Module.constructor._load() bypass by adding constructor property protection * CVE-2023-32006: prevent require.main.constructor and require.extensions bypass by implementing secure module loading validation - CVE-2023-32002, CVE-2023-32006 - debian/patches/CVE-2024-25629.patch: fix ares__read_line() function to prevent out-of-bounds read when parsing configuration files with embedded NULL characters - CVE-2024-25629 - debian/patches/CVE-2024-28863.patch: prevent extraction in excessively deep sub-folders to address unlimited sub-folders vulnerability - CVE-2024-28863 - debian/patches/CVE-2025-23085.patch: fix HTTP/2 memory leak on premature socket close or invalid header (ERR_PROTO) - CVE-2025-23085 - debian/patches/CVE-2024-27983.patch: close HTTP/2 streams during session destruction to prevent memory leak and DoS - CVE-2024-27983 Critical TuxCare License Agreement CVE-2023-23918 CVE-2023-30589 CVE-2023-32006 CVE-2023-32002 CVE-2023-32559 CVE-2023-30590 CVE-2024-25629 CVE-2024-28863 CVE-2025-23085 CVE-2024-27983 Debian 10 * Fix build for debian 11. Important TuxCare License Agreement CVE-2022-32212 Debian 10 * SECURITY UPDATE: Node.js policy integrity check bypass vulnerability - debian/patches/CVE-2023-38552.patch: use tamper-proof integrity check function to prevent tampering with Hash class internals in policy mechanism - CVE-2023-38552 Important TuxCare License Agreement CVE-2023-38552 Debian 10 * SECURITY UPDATE: Marvin Attack vulnerability in Node.js – debian/patches/CVE-2023-46809.patch: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style padding‑oracle attack that could allow recovery of sensitive data. – CVE-2023-46809 Moderate TuxCare License Agreement CVE-2023-46809 Debian 10 * SECURITY UPDATE: Marvin Attack vulnerability in Node.js – debian/patches/CVE-2023-46809.patch: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style padding‑oracle attack that could allow recovery of sensitive data. – CVE-2023-46809 Moderate TuxCare License Agreement CVE-2023-46809 Debian 10 * SECURITY UPDATE: Node.js improper handling of OBS folded headers - debian/patches/CVE-2024-27982.patch: disallow OBS folding in HTTP headers by default - CVE-2024-27982 Moderate TuxCare License Agreement CVE-2024-27982 Debian 10 * SECURITY UPDATE: Node.js policy integrity check bypass vulnerability - debian/patches/CVE-2023-38552.patch: use tamper-proof integrity check function to prevent tampering with Hash class internals in policy mechanism - CVE-2023-38552 Important TuxCare License Agreement CVE-2023-38552 Debian 10 * SECURITY UPDATE: Node.js improper handling of OBS folded headers - debian/patches/CVE-2024-27982.patch: disallow OBS folding in HTTP headers by default - CVE-2024-27982 Moderate TuxCare License Agreement CVE-2024-27982 Debian 10 * SECURITY UPDATE: Node.js SignTraits::DeriveBits() remote crash vulnerability - debian/patches/CVE-2024-22019.patch: fix improper exception handling in SignTraits::DeriveBits() that could lead to remote denial of service (process crash) when malformed input is processed - CVE-2024-22019 Important TuxCare License Agreement CVE-2024-22019 Debian 10 * SECURITY UPDATE: Node.js improper handling of OBS folded headers - debian/patches/CVE-2024-27982.patch: disallow OBS folding in HTTP headers by default - CVE-2024-27982 Moderate TuxCare License Agreement CVE-2022-32215 CVE-2022-32213 CVE-2022-35256 CVE-2022-32214 CVE-2024-27982 Debian 10 * SECURITY UPDATE: Node.js zlib denial of service vulnerability - debian/patches/CVE-2024-22025.patch: pause stream if outgoing buffer is full to prevent resource exhaustion during decompression - CVE-2024-22025 Moderate TuxCare License Agreement CVE-2024-22025 Debian 10 * SECURITY UPDATE: Node.js zlib denial of service vulnerability - debian/patches/CVE-2024-22025.patch: pause stream if outgoing buffer is full to prevent resource exhaustion during decompression - CVE-2024-22025 Moderate TuxCare License Agreement CVE-2024-22025 Debian 10 * SECURITY UPDATE: Node.js zlib denial of service vulnerability - debian/patches/CVE-2024-22025.patch: pause stream if outgoing buffer is full to prevent resource exhaustion during decompression - CVE-2024-22025 Moderate TuxCare License Agreement CVE-2023-46809 CVE-2024-22025 Debian 10 * SECURITY UPDATE: Node.js undici cross-origin redirect vulnerability - debian/patches/CVE-2023-45143.patch: clear Cookie and Host headers on cross-origin redirects to prevent sensitive data leakage - CVE-2023-45143 Low TuxCare License Agreement CVE-2023-45143 Debian 10 * SECURITY UPDATE: Remote crash vulnerability - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close - CVE-2025-59465 Important TuxCare License Agreement CVE-2025-59465 Debian 10 * SECURITY UPDATE: Remote crash vulnerability - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close - CVE-2025-59465 Important TuxCare License Agreement CVE-2025-59465 Debian 10 * SECURITY UPDATE: Remote crash vulnerability - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close - CVE-2025-59465 Important TuxCare License Agreement CVE-2025-59465 Debian 10 * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation to remove zero-fill toggle mechanism that could expose uninitialized memory when using vm module with timeout options - CVE-2025-55131 Important TuxCare License Agreement CVE-2025-55131 Debian 10 * SECURITY UPDATE: Remote crash vulnerability - debian/patches/CVE-2025-59465.patch: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close - CVE-2025-59465 Important TuxCare License Agreement CVE-2025-59465 Debian 10 * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation to remove zero-fill toggle mechanism that could expose uninitialized memory when using vm module with timeout options - CVE-2025-55131 Important TuxCare License Agreement CVE-2025-55131 Debian 10 * SECURITY UPDATE: Stack overflow exception handling in async_hooks - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions in async_hooks instead of calling FatalException - CVE-2025-59466 * SECURITY UPDATE: TLS callback exception handling vulnerability - debian/patches/CVE-2026-21637.patch: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers - CVE-2026-21637 Important TuxCare License Agreement CVE-2026-21637 CVE-2025-59466 Debian 10 * SECURITY UPDATE: TLS callback exception handling vulnerability - debian/patches/CVE-2026-21637.patch: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers - CVE-2026-21637 * SECURITY UPDATE: Stack overflow exception handling in async_hooks - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions in async_hooks instead of calling FatalException - CVE-2025-59466 Important TuxCare License Agreement CVE-2025-59466 CVE-2026-21637 Debian 10 * SECURITY UPDATE: TLS callback exception handling vulnerability - debian/patches/CVE-2026-21637.patch: wrap pskCallback and ALPNCallback invocations in try-catch blocks to route exceptions through error handlers - CVE-2026-21637 * SECURITY UPDATE: Stack overflow exception handling in async_hooks - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions in async_hooks instead of calling FatalException - CVE-2025-59466 Important TuxCare License Agreement CVE-2026-21637 CVE-2025-59466 Debian 10 * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation to remove zero-fill toggle mechanism that allowed JavaScript to control ArrayBuffer initialization via shared memory, preventing race condition that could expose uninitialized memory when using vm module with timeouts - CVE-2025-55131 Important TuxCare License Agreement CVE-2025-55131 Debian 10 * SECURITY UPDATE: Node.js buffer allocation race condition vulnerability - debian/patches/CVE-2025-55131.patch: refactor unsafe buffer creation to remove zero-fill toggle mechanism that allowed JavaScript to control ArrayBuffer initialization via shared memory, preventing race condition that could expose uninitialized memory when using vm module with timeouts - CVE-2025-55131 Important TuxCare License Agreement CVE-2025-55131 Debian 10 * SECURITY UPDATE: Stack overflow exception handling in async_hooks - debian/patches/CVE-2025-59466.patch: rethrow stack overflow exceptions in async_hooks instead of calling FatalException - CVE-2025-59466 * SECURITY UPDATE: TLS callback exception handling vulnerability - debian/patches/CVE-2026-21637.patch: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers - CVE-2026-21637 Important TuxCare License Agreement CVE-2026-21637 CVE-2025-59466 Debian 10 * SECURITY UPDATE: undici predictable multipart/form-data boundary - debian/patches/CVE-2025-22150.patch: replace Math.random() with crypto.randomInt() for the boundary string in bundled undici (deps/undici/src/lib/fetch/body.js). Math.random() output is predictable from a few sampled values, allowing attackers who can observe multipart requests to attacker-controlled servers to tamper with subsequent requests to backend APIs. - CVE-2025-22150 Moderate TuxCare License Agreement CVE-2025-22150 Debian 10 * SECURITY UPDATE: HTTP server crash on __proto__ header - debian/patches/CVE-2026-21710.patch: initialise headersDistinct and trailersDistinct destination maps with { __proto__: null } so a __proto__ request header no longer resolves to Object.prototype and cause an uncaught TypeError when req.headersDistinct or req.trailersDistinct is accessed - CVE-2026-21710 Important TuxCare License Agreement CVE-2026-21710 Debian 10 * SECURITY UPDATE: HTTP server crash on __proto__ header - debian/patches/CVE-2026-21710.patch: initialise headersDistinct and trailersDistinct destination maps with { __proto__: null } so a __proto__ request header no longer resolves to Object.prototype and cause an uncaught TypeError when req.headersDistinct or req.trailersDistinct is accessed - CVE-2026-21710 Important TuxCare License Agreement CVE-2026-21710 Debian 10 * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after invalid connection-level WINDOW_UPDATE instead of leaking - CVE-2026-21714 Moderate TuxCare License Agreement CVE-2026-21714 Debian 10 * SECURITY UPDATE: assertion failure in url.format() on malformed IDN - debian/patches/CVE-2026-21712.patch: return original href when ada::parse fails instead of CHECK(out) crash in BindingData::Format - CVE-2026-21712 Moderate TuxCare License Agreement CVE-2026-21712 Debian 10 * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after invalid connection-level WINDOW_UPDATE instead of leaking - CVE-2026-21714 Moderate TuxCare License Agreement CVE-2026-21714 Debian 10 * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after invalid connection-level WINDOW_UPDATE instead of leaking - CVE-2026-21714 Moderate TuxCare License Agreement CVE-2026-21713 CVE-2026-21714 Debian 10 * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in the internal string table, letting attacker-controlled JSON.parse input degrade performance in a local PoC against V8 8.4.371.23 - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants (no upstream V8 8.4 backport exists; this is an adapted reduced port — no rapidhash/HashSeed-view refactor) - CVE-2026-21717 Moderate TuxCare License Agreement CVE-2026-21717 Debian 10 * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in the internal string table, letting attacker-controlled JSON.parse input degrade performance in a local PoC against V8 9.4.146.26 - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants (no upstream Node.js 16 fix exists — 16.x went EOL before disclosure; this is an adapted reduced port, no rapidhash / HashSeed-view refactor) - CVE-2026-21717 Moderate TuxCare License Agreement CVE-2026-21717 Debian 10 * SECURITY UPDATE: HashDoS in V8 — consecutive numeric strings collide in the internal string table, letting attacker-controlled JSON.parse input degrade performance in a local PoC against V8 10.2.154.26 - debian/patches/CVE-2026-21717.patch: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants (no upstream Node.js 18 fix exists — 18.x went EOL before disclosure; this is an adapted reduced port, no rapidhash / HashSeed-view refactor) - CVE-2026-21717 Moderate TuxCare License Agreement CVE-2026-21717 Debian 10 * SECURITY UPDATE: HashDoS via V8 array-index hash collisions - debian/patches/CVE-2026-21717.patch: scramble V8 array-index hash_field with a 3-round xorshift-multiply so consecutive numeric strings no longer hash to consecutive buckets, preventing O(n^2) HashDoS via JSON.parse - CVE-2026-21717 Moderate TuxCare License Agreement CVE-2026-21717 Debian 10 * SECURITY UPDATE: experimental policy bypass via mainModule.__proto__ - debian/patches/CVE-2023-30581.patch: install the policy-aware require() on the module prototype and assign process.mainModule via setOwnProperty(), so process.mainModule.__proto__.require() can no longer escape the --experimental-policy manifest restrictions - CVE-2023-30581 * SECURITY UPDATE: HTTP/2 Rapid Reset denial of service - debian/patches/CVE-2023-44487.patch: backport the upstream nghttp2 1.57.0 RST_STREAM token-bucket rate limiter to the bundled nghttp2 1.42.0 (default burst=1000, rate=33/s); excessive incoming RST_STREAM frames now tear the connection down with GOAWAY instead of doing unbounded per-stream work - CVE-2023-44487 Important TuxCare License Agreement CVE-2023-30581 CVE-2023-44487 Debian 10 * SECURITY UPDATE: HTTP/2 Rapid Reset (CVE-2023-44487) — a peer can cause a denial of service by rapidly opening and cancelling HTTP/2 streams (HEADERS immediately followed by RST_STREAM) without bound; the flaw is in the bundled nghttp2 library (1.47.0) - debian/patches/CVE-2023-44487.patch: minimal backport of the upstream nghttp2 RST_STREAM rate-limit mitigation (token bucket, burst=1000 rate=33/s) to deps/nghttp2; once the per-connection budget is exhausted a GOAWAY is sent. Cherry-pick of nghttp2 commit 72b4af6143 (shipped in 1.57.0), no wholesale version bump (Node 16 went EOL before the upstream fix, so no fixed 16.x exists) - CVE-2023-44487 Important TuxCare License Agreement CVE-2023-44487 Debian 10 * SECURITY UPDATE: experimental policy bypass via mainModule.__proto__ - debian/patches/CVE-2023-30581.patch: set the policy-wrapped require on Module.prototype and assign process.mainModule via setOwnProperty so process.mainModule.__proto__.require() can no longer load modules not declared in the policy manifest (backport of nodejs/node d0a8264ec9); includes the upstream regression test in test/parallel/test-policy-manifest.js adapted for node 12 (new policy-manifest fixtures) - CVE-2023-30581 * SECURITY UPDATE: HTTP/2 Rapid Reset denial of service - debian/patches/CVE-2023-44487.patch: backport the nghttp2 RST_STREAM rate-limit mitigation into bundled deps/nghttp2 (token-bucket limiter, default burst 1000 / rate 33, GOAWAY with INTERNAL_ERROR on exhaustion) so rapidly reset HTTP/2 streams no longer exhaust server resources (backport of nghttp2 72b4af6, shipped in nghttp2 1.57.0) - CVE-2023-44487 Important TuxCare License Agreement CVE-2023-30581 CVE-2023-44487 Debian 10 * SECURITY UPDATE: HTTP/2 client unbounded ORIGIN-frame memory growth - debian/patches/CVE-2026-48619.patch: cap the HTTP/2 client originSet at 128 entries (new maxOriginSetSize connect option) so a malicious server can no longer drive unbounded memory growth by sending repeated ORIGIN frames; the session is destroyed with the new ERR_HTTP2_TOO_MANY_ORIGINS error once the cap is exceeded (backport of nodejs/node c79968e108) - CVE-2026-48619 * SECURITY UPDATE: embedded-NUL hostname authority rebinding - debian/patches/CVE-2026-48930.patch: reject hostnames containing an embedded NUL byte in dns.lookup(), dnsPromises.lookup() and net.connect()/net.createConnection() by adding validateStringWithoutNullBytes, preventing silent authority rebinding caused by C-string truncation in the resolver bindings (backport of nodejs/node 7dafafa2) - CVE-2026-48930 * SECURITY UPDATE: cipher output-length signed integer overflow - debian/patches/CVE-2026-48933.patch: guard the legacy CipherBase::Update() output-length computation against signed-int overflow (reject when len + block_size > INT_MAX), turning ~2 GiB one-shot crypto.createCipheriv().update() inputs into a clean failure instead of an out-of-bounds write; legacy-path analog of the WebCrypto fix in nodejs/node 98fbc89211 (Node 12 has no WebCrypto) - CVE-2026-48933 Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 Debian 10 * SECURITY UPDATE: embedded-NUL hostnames -> silent authority rebinding - debian/patches/CVE-2026-48930.patch: reject hostnames containing an embedded NUL byte in dns.lookup(), dnsPromises.lookup() and net.connect()/net.createConnection() before they reach the C resolver, which would otherwise truncate the string at the NUL and resolve/connect to a different authority than the one validated in JavaScript. Adds validateStringWithoutNullBytes() in lib/internal/validators.js (backport of nodejs/node@7dafafa2 adapted to 14.21.3) - CVE-2026-48930 * SECURITY UPDATE: HTTP/2 client ORIGIN-frame unbounded memory growth - debian/patches/CVE-2026-48619.patch: cap the client-side originSet at a configurable maxOriginSetSize (default 128) in lib/internal/http2/core.js; a malicious server sending unlimited ORIGIN frames now trips ERR_HTTP2_TOO_MANY_ORIGINS instead of growing the set without bound (backport of nodejs/node@c79968e1) - CVE-2026-48619 * SECURITY UPDATE: cipher output-length signed-int overflow (~2 GiB input) - debian/patches/CVE-2026-48933.patch: guard the len + block_size output length computation in CipherBase::Update (src/node_crypto.cc) against signed-int overflow that produced a bogus buffer size passed to EVP_CipherUpdate() -> OOB write / crash. Node 14 predates WebCrypto, so the INT_MAX guard from nodejs/node@98fbc892 is adapted to the legacy crypto.createCipheriv().update() path - CVE-2026-48933 Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 Debian 10 * SECURITY UPDATE: http2 client Out-of-Memory via unbounded ORIGIN frames (CVE-2026-48619) — a malicious HTTP/2 server can send an unlimited number of ORIGIN frames to a node:http2 client, appending origins to the session originSet with no bound - debian/patches/CVE-2026-48619.patch: backport of upstream c79968e108 (first in v22.23.0), caps the client-side originSet (default 128, configurable via options.maxOriginSetSize) and destroys the session with ERR_HTTP2_TOO_MANY_ORIGINS once exceeded (Node 16 is EOL, no upstream 16.x fix; vulnerable onOrigin() loop present) - CVE-2026-48619 * SECURITY UPDATE: embedded-NUL hostname authority rebinding (CVE-2026-48930) — dns.lookup/dnsPromises.lookup and net.connect accepted hostnames with an embedded NUL byte, silently truncated by the NUL-terminated C resolver, so a validated hostname could resolve a different authority - debian/patches/CVE-2026-48930.patch: backport of upstream 7dafafa242 (first in v22.23.0), adds validateStringWithoutNullBytes() and rejects embedded NUL bytes in the hostname / options.host arguments before they reach the C resolver - CVE-2026-48930 * SECURITY UPDATE: WebCrypto AES cipher output-length integer overflow (CVE-2026-48933) — AES_Cipher() computed the output buffer length as a signed int, so an input length near 2 GiB overflowed and aborted the process - debian/patches/CVE-2026-48933.patch: backport of upstream 98fbc89211 (first in v22.23.0), adds the TryGetIntCipherOutputLength() guard in crypto_cipher.h and uses it in AES_Cipher() so oversized inputs fail cleanly instead of overflowing - CVE-2026-48933 Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 Debian 10 * SECURITY UPDATE: http2 client ORIGIN-frame unbounded memory growth - debian/patches/CVE-2026-48619.patch: cap the http2 client originSet size (default 128, configurable via the connect() maxOriginSetSize option) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS once exceeded, so a malicious server can no longer grow originSet without bound (no upstream Node.js 18 fix exists — 18.x went EOL before disclosure; adapted from c79968e108, first in v22.23.0) - CVE-2026-48619 * SECURITY UPDATE: embedded-NUL hostnames cause silent authority rebinding - debian/patches/CVE-2026-48930.patch: add validateStringWithoutNullBytes and reject hostnames/hosts containing an embedded NUL byte in dns.lookup(), dnsPromises.lookup() and net.connect()/createConnection(), preventing c-string truncation in the resolver bindings from resolving a different authority than the one validated (adapted from 7dafafa2, first in v22.23.0) - CVE-2026-48930 * SECURITY UPDATE: WebCrypto cipher output-length signed integer overflow - debian/patches/CVE-2026-48933.patch: guard the WebCrypto AES output length with TryGetIntCipherOutputLength so inputs near 2 GiB fail cleanly instead of overflowing the signed int buffer length and aborting the process (adapted from 98fbc89211, first in v22.23.0) - CVE-2026-48933 Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 Debian 10 * SECURITY UPDATE: HTTP/2 client ORIGIN-frame unbounded memory growth - debian/patches/CVE-2026-48619.patch: cap the client-side originSet (maxOriginSetSize, default 128) in lib/internal/http2/core.js and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS - CVE-2026-48619 * SECURITY UPDATE: embedded-NUL hostnames cause silent authority rebinding - debian/patches/CVE-2026-48930.patch: add validateStringWithoutNullBytes in lib/internal/validators.js and reject embedded-NUL hostnames in lib/dns.js, lib/internal/dns/promises.js and lib/net.js - CVE-2026-48930 * SECURITY UPDATE: WebCrypto cipher output-length integer overflow - debian/patches/CVE-2026-48933.patch: add TryGetIntCipherOutputLength in src/crypto/crypto_cipher.h and guard the AES_Cipher output length in src/crypto/crypto_aes.cc against signed int overflow - CVE-2026-48933 Critical TuxCare License Agreement CVE-2023-32003 CVE-2026-48933 CVE-2026-48930 CVE-2023-30582 CVE-2026-48619 CVE-2024-37372 CVE-2023-32005 Debian 10 * SECURITY UPDATE: Permission Model bypass via process.report.writeReport() path misvalidation - debian/patches/CVE-2026-48617.patch: gate writeReport() in lib/internal/process/report.js on permission.has('fs.write', ...) for the supplied file or the current working directory, throwing ERR_ACCESS_DENIED instead of writing a diagnostic report outside the --allow-fs-write allow-list - CVE-2026-48617 * SECURITY UPDATE: Permission Model bypass via FileHandle.utimes() in the promises API - debian/patches/CVE-2026-48935.patch: throw ERR_ACCESS_DENIED from futimes() in lib/internal/fs/promises.js when the Permission Model is enabled, so file timestamps can no longer be modified through a read-only FileHandle - CVE-2026-48935 Moderate TuxCare License Agreement CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-48618 Debian 10 * SECURITY UPDATE: HTTP request smuggling via improper HTTP/1 header termination in the bundled llhttp parser - debian/patches/CVE-2025-23167.patch: restore terminator validation in the loose (non-strict) state machine of the bundled llhttp 6.1.1, which Node compiles by default (LLHTTP_STRICT_MODE is never set): headers_almost_done, chunk_size_almost_done and the chunk_data_almost_done / chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after a CR instead of consuming any byte, and res_line_almost_done requires the LF after the response status line's CR, so a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is rejected with HPE_STRICT instead of silently swallowing the byte and parsing the bytes that follow as a second, smuggled request; each accept/reject edge was derived from the loose machine's own goto graph rather than by copying the strict machine's labels, which are not interchangeable between the two halves (no upstream Node.js 18 fix exists — 18.x went EOL before disclosure, and upstream fixed this by replacing the parser wholesale with llhttp 9; approximated from llhttp 6d04465e, PR nodejs/llhttp#234, first in llhttp v9.0.0 / Node v20.19.2) - CVE-2025-23167 Moderate TuxCare License Agreement CVE-2025-23167 CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-48931 CVE-2026-48618 Debian 10 * SECURITY UPDATE: code injection through WebAssembly export names - debian/patches/CVE-2023-39333.patch: createDynamicModule() built the ESM facade for a wasm module by interpolating each export name raw into three code positions, so a .wasm module exporting a non-identifier name could break out of the intended syntax and evaluate arbitrary JavaScript outside the WebAssembly sandbox. The facade now uses index-derived local bindings ($export_N) and a JSONStringify-quoted import.meta.exports[...] key. Adapted from nodejs/node@eaf9083c: V8 8.4.371.23 predates ES2022 arbitrary module namespace names, so upstream's `export { $export_N as "string" }` would be a SyntaxError for every wasm module here; the export clause is instead emitted only for names matching the IdentifierName grammar, with non-identifier names reachable through import.meta.exports only (they were unimportable on this V8 either way) - CVE-2023-39333 * SECURITY UPDATE: http.Agent keep-alive response-queue poisoning - debian/patches/CVE-2026-48931.patch: once responseKeepAlive() detaches the parser and removes the 'data' listener, a socket idling in the Agent freeSockets pool has no data consumer, so unsolicited bytes from a malicious peer are consumed as the response to the *next* request that reuses the socket. Install a handle-level read guard on idle pooled sockets that destroys the socket on any such data, and remove it again in reuseSocket() (backport of nodejs/node@0a22d401 squashed with its regression follow-up nodejs/node@eaa29254, which replaces the original public 'data' listener plus resume() -- that combination put pooled sockets into flowing mode and made the shipped test-http-agent-keepalive.js fail on listenerCount('data')) - CVE-2026-48931 Low TuxCare License Agreement CVE-2026-48931 Debian 10 * SECURITY UPDATE: HTTP/2 session left alive after an internal GOAWAY - debian/patches/CVE-2026-48937.patch: when nghttp2 hits a low-level protocol error it calls nghttp2_session_terminate_session() itself, which queues a GOAWAY and returns success from nghttp2_session_mem_recv() without invoking any application-level callback. Node therefore never learned the session had died: no 'error', no 'close', and the Http2Session kept its streams, buffers and handle alive on a dead socket, which an unauthenticated peer could repeat to exhaust memory and handles. Http2Session::OnFrameSent() now flags a GOAWAY that we did not initiate ourselves and SendPendingData() raises NGHTTP2_ERR_PROTO to JavaScript once the GOAWAY has been written (backport of nodejs/node@a8a0d128; the !IsGracefulCloseInitiated() term is dropped because Node 14 has no graceful_close_initiated_ flag -- session.close() reaches the native layer through Http2Session::Goaway(), covered by the new goaway_initiated_ flag, and Http2Session::Close() sets the closing flag before terminating the session). Only the new regression test is taken from upstream: the flow-control test changes there track nghttp2 v1.67.0+ behaviour, while this release bundles 1.42.0, where a stream-level flow control violation still yields RST_STREAM - CVE-2026-48937 Low TuxCare License Agreement CVE-2026-48937 Debian 10 * SECURITY UPDATE: TLS wildcard-depth authentication bypass via Unicode dot separators - debian/patches/CVE-2026-48618.patch: normalize the peer hostname with domainToASCII() before splitting it into DNS labels in tls.checkServerIdentity(), so the verifier counts the same labels the resolver connected to; U+3002, U+FF0E and U+FF61 can no longer defeat the wildcard-depth rule in check() and make a certificate for *.example.com authenticate a host two levels below it. Includes the required IPv6 IP-Address-SAN follow-up so IPv6 literals keep matching their IP SANs (backport of nodejs/node 1efb4ff51a and 1d87a24050) - CVE-2026-48618 * SECURITY UPDATE: uppercase SNI mTLS authorization bypass - debian/patches/CVE-2026-48928.patch: add the 'i' flag to the RegExp built by tls.Server.prototype.addContext(), so an uppercase or mixed-case SNI hostname selects its per-hostname SecureContext as RFC 6066 Section 3 requires instead of silently falling back to the server's default context and bypassing per-tenant client-certificate authorization in multi-context mTLS deployments (backport of nodejs/node 39d1d09684) - CVE-2026-48928 * SECURITY UPDATE: TLS session replay skips host identity verification - debian/patches/CVE-2026-48934.patch: bind a reusable TLS client session to the host it was authenticated for, so a session obtained from host A can no longer be replayed against host B to skip checkServerIdentity() through isSessionReused(); adds wrapSessionState()/getSessionForReuse() and an explicit TLSSocket.prototype.getSession(). The fix's optional chaining is rewritten to && form because Node 12's V8 7.8 has no ?. (backport of nodejs/node fd890ba01d) - CVE-2026-48934 * SECURITY UPDATE: https.Agent reuses connections authenticated under a different identity check - debian/patches/CVE-2026-58040.patch: bind identity checks to session and socket reuse in the https.Agent, the vector CVE-2026-48934 left open. A request supplying its own checkServerIdentity is tagged with a unique per-request index, which Agent.prototype.getName() now appends, so it gets its own pool bucket; createConnection() neither reads nor writes the TLS session cache for it, and a new keepSocketAlive() override keeps its socket out of freeSockets. A later request using the default strict check can therefore no longer inherit a session or a keep-alive socket that was authenticated under permissive rules and be reported authorized against an unverified host (backport of nodejs/node 51123159fe) - CVE-2026-58040 Important TuxCare License Agreement CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-48931 CVE-2026-48618 CVE-2026-58040 Debian 10 * SECURITY UPDATE: memory leak in HTTP/2 on flow control window overflow - debian/patches/CVE-2026-21714.patch: treat NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after invalid connection-level WINDOW_UPDATE instead of leaking - CVE-2026-21714 Moderate TuxCare License Agreement CVE-2026-21713 CVE-2026-21714 CVE-2026-21712 Debian 10 * SECURITY UPDATE: HTTP request smuggling via improper HTTP/1 header termination in the bundled llhttp parser - debian/patches/CVE-2025-23167.patch: restore terminator validation in the loose (non-strict) state machine of the bundled llhttp, which Node compiles by default (LLHTTP_STRICT_MODE is never set). node-v16.20.2.tar.gz ships llhttp 6.0.11, but CVE-2024-22019.patch and CVE-2024-27982.patch earlier in this series rebase it to 6.1.1, so this patch is derived against — and must be applied after — that rebased parser: headers_almost_done, chunk_size_almost_done and the chunk_data_almost_done / chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after a CR instead of consuming any byte, and res_line_almost_done requires the LF after the response status line's CR, so a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is rejected with HPE_STRICT instead of silently swallowing the byte and parsing the bytes that follow as a second, smuggled request; each accept/reject edge was derived from the loose machine's own goto graph rather than by copying the strict machine's labels, which are not interchangeable between the two halves (no upstream Node.js 16 fix exists — 16.x went EOL in 2023, and upstream fixed this by replacing the parser wholesale with llhttp 9; approximated from llhttp 6d04465e, PR nodejs/llhttp#234, first in llhttp v9.0.0 / Node v20.19.2) - NOTE: llhttp 6.1.1 has no LENIENT_OPTIONAL_LF_AFTER_CR flag, so unlike upstream llhttp 9 this rejection is unconditional: --insecure-http-parser can no longer restore the previous lenient framing. - NOTE: deps/undici bundles a second, prebuilt-WASM llhttp with the same defect. It is not patchable from source here and is reachable only behind --experimental-fetch (off by default); tracked separately. - CVE-2025-23167 Moderate TuxCare License Agreement CVE-2025-23167 Debian 10 * SECURITY UPDATE: HTTP request smuggling via improper HTTP/1 header termination in the bundled llhttp parser - debian/patches/CVE-2025-23167.patch: restore terminator validation in the loose (non-strict) state machine of the bundled llhttp, which Node compiles by default (LLHTTP_STRICT_MODE is never set). Unlike alt-nodejs16/18 this package still ships llhttp 2.1.6 after the whole series -- CVE-2024-22019 deliberately patches the bundled parser in place instead of rebasing it to 6.x -- so every state and error label here was re-derived on this tree and nothing was transferred from the sibling packages: headers_almost_done, chunk_size_almost_done and the chunk_data_almost_done / chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after a CR instead of consuming any byte, and res_line_almost_done requires the LF after the response status line's CR, so a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is rejected with HPE_STRICT instead of silently swallowing the byte and parsing the bytes that follow as a second, smuggled request; each accept/reject edge was derived from the loose machine's own goto graph rather than by copying the strict machine's labels, which are not interchangeable between the two halves (no upstream Node.js 14 fix exists -- 14.x went EOL in 2023, and upstream fixed this by replacing the parser wholesale with llhttp 9; approximated from llhttp 6d04465e, PR nodejs/llhttp#234, first in llhttp v9.0.0 / Node v20.19.2) - NOTE: llhttp 2.1.6 has no LENIENT_OPTIONAL_LF_AFTER_CR flag, so unlike upstream llhttp 9 this rejection is unconditional: --insecure-http-parser can no longer restore the previous lenient framing. Nothing that was previously toggleable becomes untoggleable (these states were unconditionally lenient before), but an operator relying on that flag to tolerate malformed framing will now get 400 responses. - CVE-2025-23167 Moderate TuxCare License Agreement CVE-2025-23167 Debian 10 * SECURITY UPDATE: HTTP request smuggling via improper HTTP/1 header termination in the bundled HTTP parsers - debian/patches/CVE-2025-23167.patch: restore message-framing terminator validation in both HTTP/1 parsers Node 12 bundles. In the loose (non-strict) state machine of the bundled llhttp 2.1.6, which Node compiles by default (LLHTTP_STRICT_MODE is never set): headers_almost_done, chunk_size_almost_done and the chunk_data_almost_done / chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after a CR instead of consuming any byte, and res_line_almost_done requires the LF after the response status line's CR; each accept/reject edge was derived from the loose machine's own goto graph rather than by copying the strict machine's labels, which are not interchangeable between the two halves. Node 12 additionally still bundles the legacy deps/http_parser 2.9.4 -- node.gypi links it alongside llhttp and --http-parser=legacy (also settable through NODE_OPTIONS) selects it at runtime -- and it is built with HTTP_PARSER_STRICT=0, which compiles its terminator assertions away; the same five framing checks are made unconditional there via a new FRAMING_CHECK macro. A header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT instead of silently swallowing the byte and parsing the bytes that follow as a second, smuggled request (no upstream Node.js 12 fix exists -- 12.x went EOL long before disclosure, and upstream fixed this by replacing the parser wholesale with llhttp 9; approximated from llhttp 6d04465e, PR nodejs/llhttp#234, first in llhttp v9.0.0 / Node v20.19.2) - CVE-2025-23167 Moderate TuxCare License Agreement CVE-2025-23167 Debian 10 * SECURITY UPDATE: TLS wildcard-depth authentication bypass via Unicode dot separators - debian/patches/CVE-2026-48618.patch: IDNA-normalize the peer hostname with domainToASCII() before splitHost() in tls.checkServerIdentity() (lib/tls.js), so the verifier splits the same DNS labels the resolver does; a name such as "foo。bar.example.com" can no longer be authenticated by a certificate for *.example.com. Includes the mandatory IPv6 follow-up so IP-Address SANs keep matching IPv6 hosts (backport of nodejs/node@2197a471 + @1d87a240 adapted to 14.21.3) - CVE-2026-48618 * SECURITY UPDATE: case-sensitive SNI context matching -> mTLS authorization bypass - debian/patches/CVE-2026-48928.patch: add the 'i' flag to the RegExp built by tls.Server.prototype.addContext() (lib/_tls_wrap.js), so an uppercase or mixed-case SNI hostname selects its per-hostname SecureContext instead of silently falling back to the server default and bypassing per-tenant client-certificate policy, as required by RFC 6066 Section 3 (backport of nodejs/node@39d1d096) - CVE-2026-48928 * SECURITY UPDATE: TLS host identity verification bypass via session reuse - debian/patches/CVE-2026-48934.patch: bind a reusable client TLS session to the host it was authenticated for (lib/_tls_wrap.js) by wrapping the session blob with the server identity and refusing to reuse it for a different one; a session obtained from host A can no longer be replayed against host B, where checkServerIdentity() is skipped because the session is resumed (backport of nodejs/node@fd890ba0) - CVE-2026-48934 * SECURITY UPDATE: https.Agent shares sockets and TLS sessions across different checkServerIdentity callbacks - debian/patches/CVE-2026-58040.patch: incomplete-fix follow-up to CVE-2026-48934, which bound reusable sessions to the authenticated host in lib/_tls_wrap.js but left the https.Agent layer untouched: lib/https.js never referenced checkServerIdentity, so getName() did not key on it, createConnection() cached and reused sessions purely on options._agentKey, and there was no keepSocketAlive override. A request carrying a custom per-request checkServerIdentity is now tagged with a symbol-keyed marker that is folded into the agent key, excluded from the session cache and refused re-entry to the keep-alive pool, so a connection authenticated under one callback can no longer be resumed under another -- where the identity check is skipped altogether (backport of nodejs/node@51123159, the v22.x release-line commit shipped in v22.23.2; its upstream establishTunnel() hunk is dropped because 14.21.3 has no proxy-tunnel support in lib/https.js) - CVE-2026-58040 Moderate TuxCare License Agreement CVE-2026-48934 CVE-2026-48928 CVE-2026-48618 CVE-2026-58040 Debian 10 * SECURITY UPDATE: HTTPS identity check not bound to connection or TLS session reuse (incomplete fix for CVE-2026-48934) - debian/patches/CVE-2026-58040.patch: tag request options in https.request() with a per-request kPerRequestCheckServerIdentity symbol when the caller supplies its own checkServerIdentity and the Agent was not constructed with one, key Agent.prototype.getName() on that tag, skip both the TLS session resume and the session caching listener in createConnection() for tagged requests, and add an Agent.prototype.keepSocketAlive() override in lib/https.js that refuses to park such a socket in freeSockets - CVE-2026-58040 Moderate TuxCare License Agreement CVE-2026-58040 Debian 10 * resync the alt-nodejs18-npm changelog with the package revision: the npm changelog was left at 10.8.2-18.20.8.17 while debian/changelog had advanced to 18.20.8-19, so the npm binary package shipped a revision suffix that no longer matched the runtime it ships with. Both changelogs are bumped to revision 20 rather than only fast-forwarding the npm one, because an out-of-sync revision has already been released, so the npm version has to move forward on a revision that is still free * buildsys-pre-build: assert that the revision suffix in debian/alt-nodejs*-npm.changelog matches the debian/changelog version, not just that the npm upstream version matches deps/npm/package.json, so a forgotten npm changelog bump fails the build instead of silently shipping a stale npm revision Moderate TuxCare License Agreement CVE-2026-58040 Debian 10 * SECURITY UPDATE: --inspect DNS rebinding via permissive IP validation - debian/patches/CVE-2022-43548.patch: rewrite the inspector's IsIPAddress() to parse IPv4 (dotted-decimal only) and bracketed IPv6 hosts with uv_inet_pton(), rejecting octal, hexadecimal and leading-zero octet formats and treating 0.0.0.0/8 and ::/128 as non-routable, so a Host header IP that a browser resolves differently can no longer bypass the inspector host allow-list (backport of nodejs/node 2b433af094, with follow-up 73fa9ab7a5 folded in so the IPv6 string terminator is written inside the INET6_ADDRSTRLEN buffer) - CVE-2022-43548 Important TuxCare License Agreement CVE-2022-43548 Debian 10 * SECURITY UPDATE: HTTP/2 header blocks retained by open streams evade the maxSessionMemory limit - debian/patches/CVE-2026-56846.patch: charge retained HTTP/2 header memory against the session budget. Http2Session::HandleHeadersFrame() used to call DecrementCurrentSessionMemory(stream->current_headers_length_) the moment the decoded header block was handed up to JS, even though the JS objects built from it can stay alive for the whole lifetime of the stream, so a peer that opens many streams with large header blocks and never lets them complete (initialWindowSize 0, stalled responses) keeps unbounded header memory alive while current_session_memory_ reads as near zero, maxSessionMemory never trips and no stream is rejected with NGHTTP2_ENHANCE_YOUR_CALM. Http2Stream gains a second counter, retained_headers_length_; HandleHeadersFrame() moves current_headers_length_ into it instead of decrementing the session total, and Http2Session::RemoveStream() drains both counters before releasing the stream, so header blocks reachable from JS stay accounted for exactly as the maxSessionMemory option documents (no upstream Node.js 18 fix exists -- 18.x went EOL before disclosure; backported from upstream f14d78b9e020, first in v22.23.2, whose v24.x sibling is 34ed88a06939 and whose main-branch landing is b7fd13a59a; the doc/api wording hunks are dropped) - CVE-2026-56846 * SECURITY UPDATE: HTTP/2 use-after-free when RST_STREAM for a refused stream re-enters nghttp2 from inside a receive callback - debian/patches/CVE-2026-56848.patch: defer the RST_STREAM purge while nghttp2 is in scope. Http2Stream::SubmitRstStream() force-purged pending session data through session_->SendPendingData() for every code except NGHTTP2_CANCEL, so a refused stream -- onSessionHeaders() answering a HEADERS frame for an unknown stream on an already-closed session with handle.rstStream(NGHTTP2_REFUSED_STREAM), reached from Http2Session::HandleHeadersFrame() inside OnFrameReceive() with nghttp2_session_mem_recv() still on the stack -- re-entered nghttp2_session_mem_send() inside the active receive operation, where the send path can close and free streams the receive is still using (heap-use-after-free; triggered remotely by HEADERS for fresh streams sent immediately after a GOAWAY with last_stream_id 0). SubmitRstStream() now treats NGHTTP2_REFUSED_STREAM while is_in_scope() like the existing cancel case: FlushRstStream() only, with the pending data written when the enclosing scope unwinds (no upstream Node.js 18 fix exists -- 18.x went EOL before disclosure; backported from upstream daa6d25e3dce, first in v22.23.2, whose v24.x and v26.x siblings are a77c7f7354c9 and 23b94c843ae0; the cosmetic re-indent of the pre-existing AddPendingRstStream block is not carried) - CVE-2026-56848 Important TuxCare License Agreement CVE-2026-56846 CVE-2026-56848 Debian 10 * SECURITY UPDATE: HTTP/2 header blocks handed to JS stop being charged against maxSessionMemory while they can still be kept alive, letting a remote peer exhaust memory with many stalled streams carrying large header blocks (CVE-2026-56846) - debian/patches/CVE-2026-56846.patch: add a second per-stream counter Http2Stream::retained_headers_length_ in src/node_http2.h, move current_headers_length_ into it in Http2Session::HandleHeadersFrame() instead of calling DecrementCurrentSessionMemory() there, and drain both counters from the session total in Http2Session::RemoveStream() so the header memory is un-charged only once the stream is gone; also adds the upstream regression test test/parallel/test-http2-max-session-memory-stalled-headers.js, adapted in two ways: the header block is built as an object with a multi-valued cookie field because Http2Session#request() rejects upstream's flat header array, and the server is created with maxHeaderListPairs raised to 4096 so AddHeader()'s pair-count branch cannot be what the test measures, leaving the session-memory branch as the only route - CVE-2026-56846 * SECURITY UPDATE: HTTP/2 heap use-after-free when RST_STREAM is submitted for a refused stream from inside an nghttp2 receive callback, which re-enters nghttp2's send path and frees streams the active receive is still using (CVE-2026-56848) - debian/patches/CVE-2026-56848.patch: in Http2Stream::SubmitRstStream() (src/node_http2.cc), defer the reset when Http2Session::is_in_scope() and the code is NGHTTP2_REFUSED_STREAM by calling FlushRstStream() and returning, instead of falling through to the SendPendingData() force purge; also adds the upstream regression test test/parallel/test-http2-rst-stream-reentrancy.js - CVE-2026-56848 Important TuxCare License Agreement CVE-2026-56846 CVE-2026-56848 Debian 10 * SECURITY UPDATE: HTTP/2 header blocks retained by open streams evade the maxSessionMemory limit - debian/patches/CVE-2026-56846.patch: keep the decoded header block charged against maxSessionMemory for as long as the stream can still reach it (src/node_http2.{cc,h}). HandleHeadersFrame() no longer un-charges current_headers_length_ the moment the block is handed to JS; it moves the amount into a new per-stream counter, Http2Stream::retained_headers_length_, and RemoveStream() drains both counters when the stream is erased. Without this, a peer that opens many streams with large header blocks and never lets them complete (for example with initialWindowSize 0) keeps unbounded header memory alive while the credit-based limit reads as near zero, so CanAddStream() never refuses a new stream and nghttp2 never answers NGHTTP2_ENHANCE_YOUR_CALM -- remote memory exhaustion (backport of nodejs/node@f14d78b9, the v22.x release-line commit shipped in v22.23.2, carrying the upstream regression test with two deviations. The header block is built as an object with a multi-valued cookie field because 14.21.3's Http2Session#request() rejects the flat array upstream passes; that one is required, or the test throws ERR_INVALID_ARG_TYPE before it ever reaches the fix. The server also raises maxHeaderListPairs to 4096, which is hardening: it puts the pair-count branch of AddHeader() structurally out of reach, leaving the session-memory branch as the only thing the test can be measuring. The wire shape still matches upstream's -- 120 cookie fields plus four pseudo-headers, 124 entries. The three doc/api/http2.md hunks are deliberately omitted, so the -docs sub-package keeps describing maxSessionMemory without the "header blocks retained by open streams" clause) - CVE-2026-56846 * SECURITY UPDATE: HTTP/2 re-entrant RST_STREAM for refused streams -> heap use-after-free - debian/patches/CVE-2026-56848.patch: stop force-purging pending session data when a RST_STREAM is submitted for a refused stream from inside an nghttp2 callback scope (src/node_http2.cc). Http2Stream::SubmitRstStream() previously called session_->SendPendingData() for every code except NGHTTP2_CANCEL, re-entering nghttp2_session_mem_send() while nghttp2_session_mem_recv() was still on the stack, and the send path could close and free streams the active receive operation was still using. NGHTTP2_REFUSED_STREAM now takes the same deferred path: the reset is flushed with FlushRstStream() and the pending data is left for the enclosing Http2Scope to send. Reachable by sending GOAWAY with last_stream_id 0 immediately followed by HEADERS for further streams, which nghttp2 refuses from inside the same receive callback (backport of nodejs/node@daa6d25e, the v22.x release-line commit shipped in v22.23.2, carrying the upstream regression test verbatim; upstream's cosmetic re-indent of the pre-existing AddPendingRstStream block is not carried) - CVE-2026-56848 Important TuxCare License Agreement CVE-2026-56846 CVE-2026-56848 Debian 10 * SECURITY UPDATE: HTTP/2 header blocks retained by open streams escape the maxSessionMemory accounting - debian/patches/CVE-2026-56846.patch: keep a decoded HTTP/2 header block charged against maxSessionMemory while the JS objects built from it can still keep it alive. A new Http2Stream::retained_headers_length_ accumulates what Http2Session::HandleHeadersFrame() used to un-charge the moment it handed the headers up to JS, and Http2Session::RemoveStream() drains both counters when the stream leaves the session. A peer that opens many streams with large header blocks and never lets them complete can therefore no longer hold unbounded header memory alive while the credit-based limit reads as near zero. Node 12's RemoveStream() takes the stream as a parameter rather than looking it up by id, and its now-redundant un-charge in Http2Stream::~Http2Stream() is removed so the counter is not decremented twice (backport of nodejs/node f14d78b9e0) - CVE-2026-56846 * SECURITY UPDATE: HTTP/2 use-after-free via re-entrant RST_STREAM for a refused stream - debian/patches/CVE-2026-56848.patch: stop Http2Stream::SubmitRstStream() from force-purging the session's pending outbound data for a refused stream. Resetting a stream that nghttp2 refused after a GOAWAY happens from inside a receive callback, where session_->SendPendingData() re-enters nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still on the stack and can close and free streams the active receive operation is still using. Such a reset now goes out through FlushRstStream() alone, extending to NGHTTP2_REFUSED_STREAM the deferral that already covered NGHTTP2_CANCEL (backport of nodejs/node daa6d25e3d) - CVE-2026-56848 Important TuxCare License Agreement CVE-2026-56846 CVE-2026-56848 Debian 10 * SECURITY UPDATE: HTTP/2 header blocks retained by JS evade maxSessionMemory (CVE-2026-56846) -- Http2Session::HandleHeadersFrame() un-charged the decoded header block from the session memory total as soon as it handed the headers to the JS layer, but those JS objects can keep the block alive for the whole lifetime of the stream, so a peer that opens many streams with large header blocks and never lets them complete keeps unbounded header memory reachable while currentSessionMemory reads near zero and maxSessionMemory never refuses a stream - debian/patches/CVE-2026-56846.patch: backport of upstream f14d78b9e020 (first in v22.23.2), moving the octets into a new per-stream counter retained_headers_length_ instead of decrementing the session total, and draining both header counters in Http2Session::RemoveStream() so the accounting is released exactly when the stream goes away (Node 16 is EOL, no upstream 16.x fix) - CVE-2026-56846 * SECURITY UPDATE: HTTP/2 heap use-after-free via re-entrant RST_STREAM for a refused stream (CVE-2026-56848) -- Http2Stream::SubmitRstStream() deferred its force purge of pending session data only for NGHTTP2_CANCEL, so for a refused stream it called SendPendingData(), and hence nghttp2_session_mem_send(), while nghttp2_session_mem_recv() was still on the stack; the send path can then close and free streams the in-flight receive operation is still using - debian/patches/CVE-2026-56848.patch: backport of upstream daa6d25e3dce (first in v22.23.2), adding a second early return that calls FlushRstStream() and returns when the session is in scope and the code is NGHTTP2_REFUSED_STREAM, so the frame goes through nghttp2's normal queue instead of a re-entrant purge (Node 16 is EOL, no upstream 16.x fix) - CVE-2026-56848 Important TuxCare License Agreement CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-56846 CVE-2026-56848 CVE-2026-48931 CVE-2026-48618 CVE-2026-58040 Debian 10 * SECURITY UPDATE: Permission Model allow-list radix tree grants an unlisted sibling path when three or more --allow-fs-read / --allow-fs-write entries share a common prefix - debian/patches/CVE-2026-58043.patch: in FSPermission::RadixTree::Node::CreateChild(), stop unconditionally marking an internal split node as an explicit leaf when a new, longer allow-list entry is inserted past it, so a node created only to branch to more specific sibling entries (e.g. secret1, secret2, secret3) no longer becomes an implicitly granted path of its own (e.g. secret) - CVE-2026-58043 Important TuxCare License Agreement CVE-2026-58043 alt-nodejs18-docs alt-nodejs18-nodejs alt-nodejs18-nodejs-devel alt-nodejs18-npm alt-nodejs14-docs alt-nodejs14-nodejs alt-nodejs14-nodejs-devel alt-nodejs14-npm alt-nodejs16-docs alt-nodejs16-nodejs alt-nodejs16-nodejs-devel alt-nodejs16-npm alt-nodejs12-docs alt-nodejs12-nodejs alt-nodejs12-nodejs-devel alt-nodejs12-npm alt-nodejs20-docs alt-nodejs20-nodejs alt-nodejs20-nodejs-devel alt-nodejs20-npm amd64 0:18.20.8-1+tuxcare.els1 amd64 0:10.8.2-18.20.8.1 amd64 0:14.21.3-5 amd64 0:6.14.18-14.21.3.4 amd64 0:14.21.3-7 amd64 0:6.14.18-14.21.3.7 amd64 0:16.20.2-3 amd64 0:8.19.4-16.20.2.3 amd64 0:12.22.12-5 amd64 0:6.14.16-12.22.12.5 amd64 0:12.22.12-7 amd64 0:6.14.16-12.22.12.7 amd64 0:14.21.3-9 amd64 0:6.14.18-14.21.3.9 amd64 0:14.21.3-11 amd64 0:6.14.18-14.21.3.11 amd64 0:16.20.2-5 amd64 0:8.19.4-16.20.2.5 amd64 0:14.21.3-12 amd64 0:6.14.18-14.21.3.12 amd64 0:12.22.12-9 amd64 0:6.14.16-12.22.12.9 amd64 0:16.20.2-6 amd64 0:8.19.4-16.20.2.6 amd64 0:12.22.12-10 amd64 0:6.14.16-12.22.12.10 amd64 0:12.22.12-12 amd64 0:6.14.16-12.22.12.12 amd64 0:16.20.2-8 amd64 0:8.19.4-16.20.2.8 amd64 0:14.21.3-14 amd64 0:6.14.18-14.21.3.14 amd64 0:12.22.12-14 amd64 0:6.14.16-12.22.12.14 amd64 0:16.20.2-9 amd64 0:8.19.4-16.20.2.9 amd64 0:16.20.2-10 amd64 0:8.19.4-16.20.2-10 amd64 0:14.21.3-16 amd64 0:6.14.18-14.21.3-16 amd64 0:18.20.8-3 amd64 0:10.8.2-18.20.8.3 amd64 0:14.21.3-17 amd64 0:6.14.18-14.21.3-17 amd64 0:12.22.12-15 amd64 0:6.14.16-12.22.12.15 amd64 0:12.22.12-16 amd64 0:6.14.16-12.22.12.16 amd64 0:14.21.3-18 amd64 0:6.14.18-14.21.3-18 amd64 0:16.20.2-11 amd64 0:8.19.4-16.20.2-11 amd64 0:18.20.8-4 amd64 0:10.8.2-18.20.8.4 amd64 0:18.20.8-5 amd64 0:10.8.2-18.20.8.5 amd64 0:16.20.2-12 amd64 0:8.19.4-16.20.2-12 amd64 0:12.22.12-17 amd64 0:6.14.16-12.22.12.17 amd64 0:16.20.2-16 amd64 0:8.19.4-16.20.2-16 amd64 0:18.20.8-9 amd64 0:10.8.2-18.20.8.6 amd64 0:16.20.2-17 amd64 0:8.19.4-16.20.2-17 amd64 0:14.21.3-22 amd64 0:6.14.18-14.21.3-22 amd64 0:20.20.2-2 amd64 0:10.8.2-20.20.2-2 amd64 0:12.22.12-20 amd64 0:6.14.16-12.22.12.20 amd64 0:16.20.2-19 amd64 0:8.19.4-16.20.2-19 amd64 0:14.21.3-23 amd64 0:6.14.18-14.21.3-23 amd64 0:16.20.2-20 amd64 0:8.19.4-16.20.2-20 amd64 0:18.20.8-13 amd64 0:10.8.2-18.20.8.13 amd64 0:12.22.12-21 amd64 0:6.14.16-12.22.12.21 amd64 0:14.21.3-24 amd64 0:6.14.18-14.21.3-24 amd64 0:16.20.2-21 amd64 0:8.19.4-16.20.2-21 amd64 0:12.22.12-22 amd64 0:6.14.16-12.22.12.22 amd64 0:12.22.12-23 amd64 0:6.14.16-12.22.12.23 amd64 0:14.21.3-25 amd64 0:6.14.18-14.21.3-25 amd64 0:16.20.2-22 amd64 0:8.19.4-16.20.2-22 amd64 0:18.20.8-14 amd64 0:10.8.2-18.20.8.14 amd64 0:20.20.2-3 amd64 0:10.8.2-20.20.2-3 amd64 0:20.20.2-6 amd64 0:10.8.2-20.20.2-6 amd64 0:18.20.8-17 amd64 0:10.8.2-18.20.8.17 amd64 0:14.21.3-26 amd64 0:6.14.18-14.21.3-26 amd64 0:14.21.3-27 amd64 0:6.14.18-14.21.3-27 amd64 0:12.22.12-25 amd64 0:6.14.16-12.22.12.25 amd64 0:18.20.8-12 amd64 0:10.8.2-18.20.8.12 amd64 0:16.20.2-24 amd64 0:8.19.4-16.20.2-24 amd64 0:14.21.3-29 amd64 0:6.14.18-14.21.3-29 amd64 0:12.22.12-27 amd64 0:6.14.16-12.22.12.27 amd64 0:14.21.3-30 amd64 0:6.14.18-14.21.3-30 amd64 0:20.20.2-8 amd64 0:10.8.2-20.20.2-8 amd64 0:18.20.8-20 amd64 0:10.8.2-18.20.8.20 amd64 0:12.22.12-28 amd64 0:6.14.16-12.22.12.28 amd64 0:18.20.8-21 amd64 0:10.8.2-18.20.8.21 amd64 0:20.20.2-9 amd64 0:10.8.2-20.20.2-9 amd64 0:14.21.3-31 amd64 0:6.14.18-14.21.3-31 amd64 0:12.22.12-29 amd64 0:6.14.16-12.22.12.29 amd64 0:16.20.2-27 amd64 0:8.19.4-16.20.2-27 amd64 0:20.20.2-10 amd64 0:10.8.2-20.20.2-10