This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Node.js fixes 11 vulnerabilities
Node.js fixes 11 vulnerabilities in versions 22.23.2, 24.18.1 and 26.5.1. The most severe ones are described below; the rest can be found at [1].
An unauthenticated remote attacker can bypass the maxSessionMemory limit and exhaust memory due to faulty accounting of retained HTTP/2 header blocks [1][2].
The vulnerability is present in product:
- Node.js; >=24.0, <=24.18.1; >=22.0, <22.23.2
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-56846 at cve.org, NVD
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
The vulnerability was publicly disclosed 29. 7. 2026.
An authenticated local attacker who has been granted access to a single path in the permission model can read or write files outside the allowed list of paths due to faulty evaluation of prefix boundaries [1][3].
The vulnerability is present in product:
- Node.js; >=26.0, <=26.5.1; >=24.0, <=24.18.1; >=22.0, <22.23.2
CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
More information:
- CVE-2026-58043 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 29. 7. 2026.
An unauthenticated remote attacker can trigger a heap-use-after-free vulnerability due to faulty reentrant HTTP/2 processing in Node.js [1][4].
The vulnerability is present in product:
- Node.js; >=26.0, <=26.5.1; >=24.0, <=24.18.1; >=22.0, <22.23.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-56848 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 29. 7. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 4. 8. 2026.