nodejs:24 security, bug fix, and enhancement update
エラータID: AXSA:2026-1352:01
リリース日:
2026/07/27 Monday - 20:51
題名:
nodejs:24 security, bug fix, and enhancement update
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Node.js の undici には、リモートの攻撃者により、巧妙に細工
された Set-Cookie ヘッダの送信を介して、情報の漏洩、およびデータ
破壊を可能とする脆弱性が存在します。(CVE-2026-11525)
- Node.js の undici には、リソースの制限を実施していない問題
があるため、リモートの攻撃者により、サービス拒否攻撃 (DoS) を
可能とする脆弱性が存在します。(CVE-2026-12151)
- JavaScript の ip-address ライブラリには、リモートの攻撃者
により、クロスサイトスクリプティング攻撃を可能とする脆弱性が
存在します。(CVE-2026-42338)
- Node.js には、エラーメッセージに意図しない情報を出力してしまう
問題があるため、リモートの攻撃者により、エラーメッセージからの情報
の漏洩を可能とする脆弱性が存在します。(CVE-2026-48615)
- Node.js には、認証を回避できてしまう問題があるため、リモートの
攻撃者により、情報の漏洩を可能とする脆弱性が存在します。
(CVE-2026-48618)
- Node.js には、リソースの制限を実施していない問題があるため、
リモートの攻撃者により、サービス拒否攻撃 (DoS) を可能とする脆弱性
が存在します。(CVE-2026-48619)
- Node.js には、認証を回避できてしまう問題があるため、リモートの
攻撃者により、情報の漏洩、およびデータ破壊を可能とする脆弱性が存在
します。(CVE-2026-48928)
- Node.js には、TLS の処理においてホスト名に NULL が埋め込まれる
ことを許容してしまう問題があるため、リモートの攻撃者により、情報
の漏洩、データ破壊、およびサービス拒否攻撃を可能とする脆弱性が存在
します。(CVE-2026-48930)
- Node.js の WebCrypto の実装には、リソースの制限を実施していない
問題があるため、リモートの攻撃者により、サービス拒否攻撃 (DoS) を
可能とする脆弱性が存在します。(CVE-2026-48933)
- Node.js には、証明書の検証処理に問題があるため、リモートの
攻撃者により、不正な認証を可能とする脆弱性が存在します。
(CVE-2026-48934)
- Node.js の Permission API には、ローカルの攻撃者により、
データ破壊を可能とする脆弱性が存在します。(CVE-2026-48935)
- Undici の HTTP/1.1 クライアントには、リモートの攻撃者により、
データ破壊を可能とする脆弱性が存在します。(CVE-2026-6733)
- undici の Socks5ProxyAgent には、機密情報を誤った宛先に送信
してしまう問題があるため、リモートの攻撃者により、情報の漏洩、
データ破壊、およびサービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2026-6734)
- undici には、リモートの攻撃者により、情報の漏洩を可能とする
脆弱性が存在します。(CVE-2026-9678)
- undici の ProxyAgent には、中間者攻撃を許容してしまう問題
があるため、リモートの攻撃者により、情報の漏洩、および任意の
コードの実行を可能とする脆弱性が存在します。(CVE-2026-9697)
Modularity name: nodejs
Stream name: 24
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-11525
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.
CVE-2026-12151
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
CVE-2026-42338
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
CVE-2026-48615
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48618
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48619
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48928
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48933
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48934
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48935
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-6733
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
CVE-2026-6734
Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.
Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.
CVE-2026-9678
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
CVE-2026-9697
Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange. Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.
Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange. Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.
追加情報:
N/A
ダウンロード:
SRPMS
- nodejs-nodemon-3.0.3-1.module+el8+2011+4f5d9e9c.src.rpm
MD5: dc2343bc1c7887127d4c75cbd4e28095
SHA-256: 985d5a75df86a551c21ea3f43f7fdaaa2668db2e03841e4684a8cc4f85479054
Size: 857.57 kB - nodejs-packaging-2021.06-6.module+el8+2011+4f5d9e9c.src.rpm
MD5: 0b9af50d9d3460b9464c4d8873b0731d
SHA-256: 1163676258d2e44abe2eb1d32c2c3c564b77330567bf289e4c92efe4bf41dfef
Size: 30.67 kB - nodejs-24.18.0-1.module+el8+2011+4f5d9e9c.src.rpm
MD5: a130dd38a475b53f7dfa59a9406012b8
SHA-256: e885b24bcdd61ddb565d537cd4a132a5e31f5f2dcb515f5e1abb8d31cf62d437
Size: 98.75 MB
Asianux Server 8 for x86_64
- nodejs-24.18.0-1.module+el8+2011+4f5d9e9c.x86_64.rpm
MD5: 0f720db2ff9059670d62cb27bcc1802f
SHA-256: 0b7eb3a1eafc02ff3aad7aa5953044fc91b50191bfcaf2498960c27eab5729d5
Size: 67.52 kB - nodejs-debugsource-24.18.0-1.module+el8+2011+4f5d9e9c.x86_64.rpm
MD5: 2993f2ad3d469504b24d5028c7e036ac
SHA-256: 0bbd7639a19506139edda7bfa3331a52f1bd854c9ff163ca97a975392462e44a
Size: 21.48 MB - nodejs-devel-24.18.0-1.module+el8+2011+4f5d9e9c.x86_64.rpm
MD5: bc74f8382eafbcc2b333533e05fe6da7
SHA-256: b024c428bc3b5d0e765470edc05a9cc735001d1c841d8c47fc0369a384650478
Size: 330.26 kB - nodejs-docs-24.18.0-1.module+el8+2011+4f5d9e9c.noarch.rpm
MD5: 4b2f316f04bfa6504962152db4f2c5a0
SHA-256: 2731238a128751f9da3ffe5d608b719b8e2edaa978ada2cc8bd4be17c2a2d63f
Size: 6.28 MB - nodejs-full-i18n-24.18.0-1.module+el8+2011+4f5d9e9c.x86_64.rpm
MD5: 512ce84e029d55563e02a337422ea756
SHA-256: dcb4f7fe59f05211a49d5cf42770b981355e718ea20e0877ec57270515f504cc
Size: 8.61 MB - nodejs-libs-24.18.0-1.module+el8+2011+4f5d9e9c.x86_64.rpm
MD5: 4f0bc804404445b02beadfede34e8d42
SHA-256: c7e8ed406f718b4e75deff9a4ab46803758d30a7048e0c67d55e6d9079cd8803
Size: 18.83 MB - nodejs-nodemon-3.0.3-1.module+el8+2011+4f5d9e9c.noarch.rpm
MD5: f6f13db5d477a6b6e3501add6e983f1d
SHA-256: 060b566132738351ca0bd66437176e2772a01d05a5542f3b94549c33382df740
Size: 531.38 kB - nodejs-packaging-2021.06-6.module+el8+2011+4f5d9e9c.noarch.rpm
MD5: f5cfff4f11e65766de576fc4db37fc2a
SHA-256: 87e4245526874e60e59305f0a11bd42e018914660dd2cc34afb2b0ac73035d34
Size: 24.41 kB - nodejs-packaging-bundler-2021.06-6.module+el8+2011+4f5d9e9c.noarch.rpm
MD5: 732e4c3ff18398f2ce616d10173bc02b
SHA-256: 31836fcb2742cbef33e742f53d80fe1028677c6562a13f8f2942016f95f8775e
Size: 13.99 kB - npm-11.16.0-1.24.18.0.1.module+el8+2011+4f5d9e9c.noarch.rpm
MD5: 2c0e38423911332b2a4c116164354024
SHA-256: 8df6f097f3bec6707a5c9ad2d36a176f107c63bfbf64a231afa9b1930a688b09
Size: 2.30 MB - v8-13.6-devel-13.6.233.17-1.24.18.0.1.module+el8+2011+4f5d9e9c.x86_64.rpm
MD5: d6963cb1e45d12a04ecd54dd008452e4
SHA-256: 20cc6d89150b4dd32f8a28dc24edb62c84628af79eb5397749657aad575c32b2
Size: 33.11 kB
English