{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Node.js heeft meerdere kwetsbaarheden verholpen in versies 22.x, 24.x en 26.x, waaronder in de HTTP/2-implementatie, HTTPS-servermodule, TLS-handling en proxy error handling.", "title": "Feiten" }, { "category": "description", "text": "Verschillende kwetsbaarheden in Node.js kunnen leiden tot informatielekken, geheugenfouten en serveruitval. Vooral omgevingen met HTTP/2, HTTPS en TLS worden geraakt.\n\n- Proxy-authenticatie: uitlekken van inloggegevens via foutmeldingen.\n- HTTP/2: buffer overflow, geheugenlekken, overbelasting en servercrashes.\n- Bestandsbewaking: omzeilen van toegangsbeperkingen op macOS en Windows.\n- zlib: dienstverstoring door foutieve verwerking van datastromen.\n- HTTPS-server: geheugenfouten waardoor gevoelige gegevens, waaronder TLS-privésleutels, kunnen uitlekken.\n- TLS 1.2: omzeilen van authenticatie met clientcertificaten.\n- TLS-sessies: onjuist hergebruik van sessies met verschillende certificaatinstellingen.", "title": "Interpretaties" }, { "category": "description", "text": "Node.js heeft updates uitgebracht in versies 22.23.0, 24.17.0, 24.18.0 en 26.x om deze kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "general", "text": "Generation of Error Message Containing Sensitive Information", "title": "CWE-209" }, { "category": "general", "text": "Uncaught Exception", "title": "CWE-248" }, { "category": "general", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "general", "text": "Exposure of Private Personal Information to an Unauthorized Actor", "title": "CWE-359" }, { "category": "general", "text": "Use After Free", "title": "CWE-416" }, { "category": "general", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "general", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "general", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "general", "text": "Missing Release of Resource after Effective Lifetime", "title": "CWE-772" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Expired Pointer Dereference", "title": "CWE-825" }, { "category": "general", "text": "Exposure of Sensitive Information Through Metadata", "title": "CWE-1230" }, { "category": "general", "text": "Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls", "title": "CWE-1265" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases" } ], "title": "Kwetsbaarheden verholpen in Node.js", "tracking": { "current_release_date": "2026-11-12T14:19:29.432392Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0492", "initial_release_date": "2026-11-12T14:19:29.432392Z", "revision_history": [ { "date": "2026-11-12T14:19:29.432392Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "Node.js" } ], "category": "vendor", "name": "Open Source" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-48615", "cwe": { "id": "CWE-359", "name": "Exposure of Private Personal Information to an Unauthorized Actor" }, "notes": [ { "category": "other", "text": "Exposure of Private Personal Information to an Unauthorized Actor", "title": "CWE-359" }, { "category": "other", "text": "Generation of Error Message Containing Sensitive Information", "title": "CWE-209" }, { "category": "description", "text": "Node.js versions 22, 24, and 26 contain a vulnerability in proxy tunnel error handling that can expose proxy credentials in ERR_PROXY_TUNNEL error messages, with multiple updates released to address this and other security issues.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-48615 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-48615.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-48615" }, { "cve": "CVE-2026-123828", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Heap-based Buffer Overflow", "title": "CWE-122" }, { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "A one-byte off-by-one heap buffer overflow in Node.js HTTP/2 Alt-Svc handling allows remote attackers to corrupt memory or cause a denial of service in Node.js versions 24.x and 26.x.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123828 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123828.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123828" }, { "cve": "CVE-2026-123829", "cwe": { "id": "CWE-1230", "name": "Exposure of Sensitive Information Through Metadata" }, "notes": [ { "category": "other", "text": "Exposure of Sensitive Information Through Metadata", "title": "CWE-1230" }, { "category": "description", "text": "A permission model bypass in Node.js versions 22.x, 24.x, and 26.x on macOS and Windows allows local processes with limited read permissions to detect file and directory names and timing metadata in unauthorized subdirectories without exposing file contents.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123829 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123829.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 2.5, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123829" }, { "cve": "CVE-2026-123862", "cwe": { "id": "CWE-248", "name": "Uncaught Exception" }, "notes": [ { "category": "other", "text": "Uncaught Exception", "title": "CWE-248" }, { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "description", "text": "A vulnerability in Node.js zlib streaming API allows a remote peer to cause a denial of service by disconnecting during compression when deflate.params() is called, triggering an internal assertion error that crashes the process in versions 22.x, 24.x, and 26.x.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123862 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123862.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123862" }, { "cve": "CVE-2026-123863", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "other", "text": "Reachable Assertion", "title": "CWE-617" }, { "category": "description", "text": "A critical vulnerability in Node.js HTTP/2 session teardown allows unauthenticated remote attackers to cause a denial of service by triggering a memory assertion failure and server crash during session cleanup in versions 26.x and 24.x.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123863 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123863.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 8.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123863" }, { "cve": "CVE-2026-123864", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "other", "text": "Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls", "title": "CWE-1265" }, { "category": "description", "text": "A re-entrancy use-after-free vulnerability in Node.js HTTPS server allows unauthenticated remote attackers to leak sensitive memory, including TLS private keys and user requests, by exploiting specific streaming and header-flushing behaviors during request handling.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123864 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123864.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123864" }, { "cve": "CVE-2026-123865", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "category": "other", "text": "Missing Release of Resource after Effective Lifetime", "title": "CWE-772" }, { "category": "description", "text": "Node.js versions 22.x, 24.x, and 26.x are vulnerable to unauthenticated HTTP/2 protocol errors that cause indefinite memory and file descriptor leaks during session shutdown, leading to denial of service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123865 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123865.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123865" }, { "cve": "CVE-2026-123866", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "other", "text": "Expired Pointer Dereference", "title": "CWE-825" }, { "category": "description", "text": "A use-after-free vulnerability in Node.js HTTP/2 stream teardown can cause memory leaks of response and unrelated heap data to remote peers during backpressured writes, affecting Node.js versions 22.x, 24.x, and 26.x.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123866 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123866.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123866" }, { "cve": "CVE-2026-123867", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "other", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "description", "text": "A Node.js vulnerability allows clients authorized for the default hostname to bypass mutual TLS restrictions and access protected hostnames due to improper handling of client certificate authorities when no server certificate is set in the SNI context.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123867 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123867.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 4.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123867" }, { "cve": "CVE-2026-123868", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "other", "text": "Allocation of Resources Without Limits or Throttling", "title": "CWE-770" }, { "category": "description", "text": "A Node.js vulnerability in versions 24.x and 26.x allows unauthenticated HTTP/2 clients to exhaust server memory by sending numerous small DATA frames, leading to denial of service through excessive memory retention.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123868 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123868.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123868" }, { "cve": "CVE-2026-123871", "cwe": { "id": "CWE-209", "name": "Generation of Error Message Containing Sensitive Information" }, "notes": [ { "category": "other", "text": "Generation of Error Message Containing Sensitive Information", "title": "CWE-209" }, { "category": "description", "text": "Node.js versions 22.x, 24.x, and 26.x contain a moderate-severity vulnerability where proxy authentication credentials are exposed in ERR_PROXY_INVALID_CONFIG error messages due to incomplete redaction in error handling.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123871 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123871.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123871" }, { "cve": "CVE-2026-123872", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "other", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "description", "text": "A Node.js TLS vulnerability allows authenticated attackers to bypass client certificate authentication by renegotiating TLS 1.2 connections and changing the server name, affecting multi-tenant environments without front-end TLS termination or TLS 1.3.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123872 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123872.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123872" }, { "cve": "CVE-2026-123874", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "other", "text": "Use After Free", "title": "CWE-416" }, { "category": "other", "text": "Expired Pointer Dereference", "title": "CWE-825" }, { "category": "description", "text": "A use-after-free vulnerability in Node.js HTTP/2 allows unauthenticated remote attackers to corrupt server memory and cause denial of service when serving files using respondWithFile() or respondWithFD(), affecting Node.js versions 26.9.0+ and 24.22.0+.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123874 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123874.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123874" }, { "cve": "CVE-2026-123875", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "description", "text": "A NULL pointer dereference vulnerability in Node.js HTTP/2 file transfers allows unauthenticated remote attackers to cause a denial of service by aborting downloads, affecting versions 22.x, 24.x, and 26.x.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123875 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123875.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123875" }, { "cve": "CVE-2026-123877", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "other", "text": "Improper Certificate Validation", "title": "CWE-295" }, { "category": "description", "text": "A certificate validation bypass in Node.js https.Agent causes identical TLS session-cache keys for requests with differing CA trust settings, enabling improper session reuse and potential exposure of confidential data to unauthorized servers.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-123877 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-123877.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-123877" }, { "cve": "CVE-2026-126051", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "other", "text": "NULL Pointer Dereference", "title": "CWE-476" }, { "category": "other", "text": "Uncaught Exception", "title": "CWE-248" }, { "category": "description", "text": "A use-after-destroy vulnerability in Node.js TLS handshake handling allows remote attackers to crash the server by exploiting deferred OpenSSL callbacks, affecting Node.js versions 24.x and 26.x and rated as Important by Red Hat.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-126051 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-126051.json" } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-126051" } ] }