nodejs:24 security, bug fix, and enhancement update
エラータID: AXSA:2026-1515:01
リリース日:
2026/08/12 Wednesday - 14:50
題名:
nodejs:24 security, bug fix, and enhancement update
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Node.js の undici には、リモートの攻撃者により、巧妙に細工
された Set-Cookie ヘッダの送信を介して、情報の漏洩、およびデータ
破壊を可能とする脆弱性が存在します。(CVE-2026-11525)
- Node.js の undici には、リソースの制限を実施していない問題
があるため、リモートの攻撃者により、サービス拒否攻撃 (DoS) を
可能とする脆弱性が存在します。(CVE-2026-12151)
- JavaScript の ip-address ライブラリには、リモートの攻撃者
により、クロスサイトスクリプティング攻撃を可能とする脆弱性が
存在します。(CVE-2026-42338)
- Node.js には、エラーメッセージに意図しない情報を出力してしまう
問題があるため、リモートの攻撃者により、エラーメッセージからの情報
の漏洩を可能とする脆弱性が存在します。(CVE-2026-48615)
- Node.js には、認証を回避できてしまう問題があるため、リモートの
攻撃者により、情報の漏洩を可能とする脆弱性が存在します。
(CVE-2026-48618)
- Node.js には、リソースの制限を実施していない問題があるため、
リモートの攻撃者により、サービス拒否攻撃 (DoS) を可能とする脆弱性
が存在します。(CVE-2026-48619)
- Node.js には、認証を回避できてしまう問題があるため、リモート
の攻撃者により、情報の漏洩、およびデータ破壊を可能とする脆弱性が
存在します。(CVE-2026-48928)
- Node.js には、TLS の処理においてホスト名に NULL が埋め込まれる
ことを許容してしまう問題があるため、リモートの攻撃者により、情報
の漏洩、データ破壊、およびサービス拒否攻撃を可能とする脆弱性が存在
します。(CVE-2026-48930)
- Node.js の WebCrypto の実装には、リソースの制限を実施していない
問題があるため、リモートの攻撃者により、サービス拒否攻撃 (DoS) を
可能とする脆弱性が存在します。(CVE-2026-48933)
- Node.js には、証明書の検証処理に問題があるため、リモートの攻撃者
により、不正な認証を可能とする脆弱性が存在します。(CVE-2026-48934)
- Node.js の Permission API には、ローカルの攻撃者により、データ
破壊を可能とする脆弱性が存在します。(CVE-2026-48935)
- Undici の HTTP/1.1 クライアントには、リモートの攻撃者により、
データ破壊を可能とする脆弱性が存在します。(CVE-2026-6733)
- undici の Socks5ProxyAgent には、機密情報を誤った宛先に送信
してしまう問題があるため、リモートの攻撃者により、情報の漏洩、
データ破壊、およびサービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2026-6734)
- undici には、リモートの攻撃者により、情報の漏洩を可能とする
脆弱性が存在します。(CVE-2026-9678)
- undici の ProxyAgent には、中間者攻撃を許容してしまう問題
があるため、リモートの攻撃者により、情報の漏洩、および任意の
コードの実行を可能とする脆弱性が存在します。(CVE-2026-9697)
Modularity name: nodejs
Stream name: 24
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-11525
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.
Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.
CVE-2026-12151
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
CVE-2026-42338
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.
CVE-2026-48615
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48618
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48619
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48928
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48933
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48934
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-48935
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVE-2026-6733
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
CVE-2026-6734
Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.
Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.
CVE-2026-9678
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored. In shared-cache mode, this allows a response containing one user's authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key. Affected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, disable shared-cache mode for traffic that includes Authorization headers, avoid caching responses to authenticated requests, or add Vary: Authorization upstream.
CVE-2026-9697
Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange. Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.
Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings. Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange. Affected applications are those that use undici's ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added. Patches: Upgrade to undici v7.28.0 or v8.5.0. Workarounds: No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.
追加情報:
N/A
ダウンロード:
SRPMS
- nodejs-nodemon-3.0.3-3.module+el9+1175+67f4a5e6.src.rpm
MD5: ef4cd1ed34ccc20d780a1275f3b002cc
SHA-256: 1992f57b4d0d249f1d2519b77ea87380020f618ce40b2fac24ceef2719b777c6
Size: 858.61 kB - nodejs-packaging-2021.06-6.module+el9+1175+67f4a5e6.src.rpm
MD5: 134e120a36b0ba64b29b2bdce4525056
SHA-256: e02b92d3e5d46d4347894038706daeea869525e5707baecfa61b856ac962ae6c
Size: 25.41 kB - nodejs-24.18.0-1.module+el9+1175+67f4a5e6.src.rpm
MD5: f617e7cb765ac1ff9bceeed28c0eca5f
SHA-256: 81d4bef04aebd37ec35dee7f05bcac4ce40ec4a9a3ff9d60307399d727f56892
Size: 98.76 MB
Asianux Server 9 for x86_64
- nodejs-24.18.0-1.module+el9+1175+67f4a5e6.x86_64.rpm
MD5: 1fc74b0fe457738ea89323685be507f6
SHA-256: 41949ceff4d12c135c803fbfe29c5fcba3771bf4b05108146af575f2407f2630
Size: 66.98 kB - nodejs-debugsource-24.18.0-1.module+el9+1175+67f4a5e6.x86_64.rpm
MD5: 2d03c978d2d406282e523ebfb2917d45
SHA-256: 3fa960c7f4d1db4f18f939904b25eb3b7dc871b8d629a6542d15e86e4a1c77f1
Size: 19.37 MB - nodejs-devel-24.18.0-1.module+el9+1175+67f4a5e6.x86_64.rpm
MD5: 2243d5ca61b3aa9106da0d01bb4631ee
SHA-256: 32d9587e24bf83d4d811e1f0583cd916cc9772c8e42fbbe01d26f3cb912c2b7e
Size: 333.19 kB - nodejs-docs-24.18.0-1.module+el9+1175+67f4a5e6.noarch.rpm
MD5: 285b93fe0d8ac23ae1c2b39b24e1bfc0
SHA-256: fa347048016bd5779b8b98a267e12625dc7da31348261fb28d78be029ac75c6d
Size: 5.07 MB - nodejs-full-i18n-24.18.0-1.module+el9+1175+67f4a5e6.x86_64.rpm
MD5: 9a31d6a6e556d3ee8d5c557504d3515e
SHA-256: ed9d3858979aa1ebc2f8c043e1411cd3ae6c0a21690b743f5aa07c8391f567a0
Size: 8.87 MB - nodejs-libs-24.18.0-1.module+el9+1175+67f4a5e6.x86_64.rpm
MD5: 1f4a33d0845033efe01b87fee6b08a6c
SHA-256: ac5ed97ec28884a5c1e456e2f576cb630def3eebc798b40c2e19a718767d240d
Size: 18.46 MB - nodejs-nodemon-3.0.3-3.module+el9+1175+67f4a5e6.noarch.rpm
MD5: 3458a363ef941de979561f82ae35651a
SHA-256: 57d80cbb1772d39c6589995d298dc13d8204a2e0639307464c6f5d6996e3c6b3
Size: 584.92 kB - nodejs-packaging-2021.06-6.module+el9+1175+67f4a5e6.noarch.rpm
MD5: f116af8178565e6698c1bd415f2f1912
SHA-256: cf25d18b5da50c7679ca7406240ba298b0d0547a50e24a6f98c5aaf051db9e8a
Size: 18.66 kB - nodejs-packaging-bundler-2021.06-6.module+el9+1175+67f4a5e6.noarch.rpm
MD5: 51174e4e77b90cbb2d973c2aa334998f
SHA-256: 83474903842b895a039b32b94db11423c22054259a2100980f9acd6cda8af189
Size: 8.47 kB - npm-11.16.0-1.24.18.0.1.module+el9+1175+67f4a5e6.noarch.rpm
MD5: abf50902024f56a79c11c5b7092c2c4b
SHA-256: 91c8315ae25ddb119d58532bafa1e284ed33a8eb331d63fc77d0663de9fd62ec
Size: 2.49 MB - v8-13.6-devel-13.6.233.17-1.24.18.0.1.module+el9+1175+67f4a5e6.x86_64.rpm
MD5: 85e8ccc7feefafca0b1ec67eef5d5932
SHA-256: 800ae008e890a087a723d5db1e6b4d586e7ee77d8626962bed9cf98edefe7908
Size: 33.16 kB
English