nodejs:22 security, bug fix, and enhancement update
エラータID: AXSA:2026-1513:01
リリース日:
2026/08/11 Tuesday - 17:43
題名:
nodejs:22 security, bug fix, and enhancement update
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Node.js の undici には、リモートの攻撃者により、巧妙に細工
された Set-Cookie ヘッダの送信を介して、情報の漏洩、およびデータ
破壊を可能とする脆弱性が存在します。(CVE-2026-11525)
- Node.js の undici には、リソースの制限を実施していない問題
があるため、リモートの攻撃者により、サービス拒否攻撃 (DoS) を
可能とする脆弱性が存在します。(CVE-2026-12151)
- JavaScript の ip-address ライブラリには、リモートの攻撃者
により、クロスサイトスクリプティング攻撃を可能とする脆弱性が
存在します。(CVE-2026-42338)
- Node.js には、エラーメッセージに意図しない情報を出力してしまう
問題があるため、リモートの攻撃者により、エラーメッセージからの情報
の漏洩を可能とする脆弱性が存在します。(CVE-2026-48615)
- Node.js には、認証を回避できてしまう問題があるため、リモートの
攻撃者により、情報の漏洩を可能とする脆弱性が存在します。
(CVE-2026-48618)
- Node.js には、リソースの制限を実施していない問題があるため、
リモートの攻撃者により、サービス拒否攻撃 (DoS) を可能とする脆弱性
が存在します。(CVE-2026-48619)
- Node.js には、認証を回避できてしまう問題があるため、リモートの
攻撃者により、情報の漏洩、およびデータ破壊を可能とする脆弱性が存在
します。(CVE-2026-48928)
- Node.js には、TLS の処理においてホスト名に NULL が埋め込まれる
ことを許容してしまう問題があるため、リモートの攻撃者により、情報
の漏洩、データ破壊、およびサービス拒否攻撃を可能とする脆弱性が存在
します。(CVE-2026-48930)
- Node.js の WebCrypto の実装には、リソースの制限を実施していない
問題があるため、リモートの攻撃者により、サービス拒否攻撃 (DoS) を
可能とする脆弱性が存在します。(CVE-2026-48933)
- Node.js には、証明書の検証処理に問題があるため、リモートの
攻撃者により、不正な認証を可能とする脆弱性が存在します。
(CVE-2026-48934)
- Node.js の Permission API には、ローカルの攻撃者により、
データ破壊を可能とする脆弱性が存在します。(CVE-2026-48935)
- Undici の HTTP/1.1 クライアントには、リモートの攻撃者により、
データ破壊を可能とする脆弱性が存在します。(CVE-2026-6733)
- undici には、リモートの攻撃者により、情報の漏洩を可能とする
脆弱性が存在します。(CVE-2026-9678)
Modularity name: nodejs
Stream name: 22
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-11525
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.
CVE-2026-12151
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
CVE-2026-42338
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
CVE-2026-48615
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48618
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48619
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48928
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48933
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48934
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48935
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-6733
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
CVE-2026-9678
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
追加情報:
N/A
ダウンロード:
SRPMS
- nodejs-nodemon-3.0.1-1.module+el9+1174+3aafd623.src.rpm
MD5: f71f36c390e0901419b658ee295a764d
SHA-256: 86da3bb539212e79c0ab9e39585d373c69daae6a0a3b256b8e1266c2ce6b90fb
Size: 339.27 kB - nodejs-packaging-2021.06-6.module+el9+1174+3aafd623.src.rpm
MD5: 7c9fca8742c636cd7af61ccfa210cbd8
SHA-256: 4c7319882c7aa264ebb1d74354484460aa74a7c516303874e9ff6b6ce79fcf79
Size: 25.40 kB - nodejs-22.23.1-1.module+el9+1174+3aafd623.src.rpm
MD5: a600b2217d935936e8d253b5b8e53674
SHA-256: 36a5f159ea2924ed4c3e8fcb316a27dc8b304a0be2423d572bb80839a33e4e58
Size: 92.10 MB
Asianux Server 9 for x86_64
- nodejs-22.23.1-1.module+el9+1174+3aafd623.x86_64.rpm
MD5: 28fccc3ce3cda6d0119dd6bc300661a5
SHA-256: 6bb150ace3adc6822badaa2a2e217c6659905b585b5604e5fa9a0cb3c899cffd
Size: 2.17 MB - nodejs-debugsource-22.23.1-1.module+el9+1174+3aafd623.x86_64.rpm
MD5: d8e91247e981e63f24f0c1cdf813562b
SHA-256: a6ffbf67993b551970cb77a055996d966981cf727e562de2caadecca5d3cdd13
Size: 18.05 MB - nodejs-devel-22.23.1-1.module+el9+1174+3aafd623.x86_64.rpm
MD5: 3db406202bd7300418f7355d1e15429f
SHA-256: 21a38dae19e848aab35eb7c8c3b95c3adbd8adb5c7e10abb1e3672344e11a7dd
Size: 276.53 kB - nodejs-docs-22.23.1-1.module+el9+1174+3aafd623.noarch.rpm
MD5: eafe61ac24c54549de50f9d5c404642c
SHA-256: 61c02d11ee0705968a221e0f5fe3932606d80aa75722b443e35013f42ad61627
Size: 9.24 MB - nodejs-full-i18n-22.23.1-1.module+el9+1174+3aafd623.x86_64.rpm
MD5: a34a5d1a816c267707ee8fc3d4953c65
SHA-256: c5bcce1a011b740a7e8ff654a8d9835cbca3b0c5d136a2a5e34f16ee164982a4
Size: 8.87 MB - nodejs-libs-22.23.1-1.module+el9+1174+3aafd623.x86_64.rpm
MD5: 34598074c09eb6aa24863a3ce2ee073e
SHA-256: 97f6ffb7883ec12a4035659a7b289a9bf629a446be8adc39e127be0ba88ea423
Size: 20.54 MB - nodejs-nodemon-3.0.1-1.module+el9+1174+3aafd623.noarch.rpm
MD5: 6f9cb5c559c2466e18440914dcd058d7
SHA-256: 0e9fab5637adb815a5bd6fda72eaa4515e4d1a8d40438023c2f0007e1fac259e
Size: 332.37 kB - nodejs-packaging-2021.06-6.module+el9+1174+3aafd623.noarch.rpm
MD5: ce146c07efb029509ddf23660a79fd23
SHA-256: 473049fdaac26e486002656e3fed6e6fba76c089e24757ee06c919f634c0b984
Size: 18.66 kB - nodejs-packaging-bundler-2021.06-6.module+el9+1174+3aafd623.noarch.rpm
MD5: 344417087dd4b7cf300a4b284c36136a
SHA-256: db15a4b9ed8380bbefc2b8505cf674bf2409cb95d58a984fd75e7f66eb0831f2
Size: 8.46 kB - npm-10.9.8-1.22.23.1.1.module+el9+1174+3aafd623.x86_64.rpm
MD5: 9e21cc6b6caa08ed6dc3825b0593e109
SHA-256: 4670162f5a10b77217e66fb79fd9c8a1c71cbc0601a9997463ec7eb2c088be5d
Size: 2.36 MB - v8-12.4-devel-12.4.254.21-1.22.23.1.1.module+el9+1174+3aafd623.x86_64.rpm
MD5: d2abd273a80d1297080c1f8da3a4e9f4
SHA-256: cc8052bbd0b24c73d16d615fd937b7d1e965d3e86edacc353368c718199e69a0
Size: 15.55 kB
English