Tuxcare Errata System 0.0.1 5.10 2026-08-27T10:53:43 Community Enterprise Operating System 10 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 CVE-2025-23085 CVE-2024-27983 CVE-2024-22019 CVE-2024-28863 CVE-2025-23166 CVE-2024-22025 CVE-2023-38552 CVE-2024-25629 CVE-2024-27982 CVE-2023-45143 CVE-2023-39333 CVE-2023-46809 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 CVE-2025-23166 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - ALTNJS-239: Fix redundant obsoletes problem Critical TuxCare License Agreement CVE-2023-46809 CVE-2023-38552 CVE-2023-30590 CVE-2024-25629 CVE-2025-23085 CVE-2023-30589 CVE-2024-27983 CVE-2024-28863 CVE-2024-27982 CVE-2023-32006 CVE-2024-22025 CVE-2023-32559 CVE-2023-32002 CVE-2024-22019 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers Important TuxCare License Agreement CVE-2026-21637 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException Important TuxCare License Agreement CVE-2026-21637 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-21637: wrap pskCallback and ALPNCallback invocations in try-catch blocks to route exceptions through error handlers - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException Important TuxCare License Agreement CVE-2026-21637 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2025-22150: undici uses predictable Math.random() for multipart/form-data boundary, allowing attackers to tamper with backend requests under certain conditions Moderate TuxCare License Agreement CVE-2025-22150 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - Remove node-gyp symlink in pretrans to prevent file conflicts on update Important TuxCare License Agreement CVE-2025-55131 CVE-2025-59466 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - Fix npm pulling in system nodejs via auto-generated Requires: /usr/bin/node Important TuxCare License Agreement CVE-2025-55131 CVE-2025-59466 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-21710: use null prototype for headersDistinct/trailersDistinct to prevent uncaught TypeError when a __proto__ header is received and the application accesses req.headersDistinct or req.trailersDistinct Important TuxCare License Agreement CVE-2026-21710 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-21710: use null prototype for headersDistinct/trailersDistinct to prevent uncaught TypeError when a __proto__ header is received and the application accesses req.headersDistinct or req.trailersDistinct Important TuxCare License Agreement CVE-2026-21710 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21713 CVE-2026-21714 CVE-2026-21712 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21714 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-21712: return original href when ada::parse fails in url.format() instead of crashing on malformed IDN hostnames Moderate TuxCare License Agreement CVE-2026-21712 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21713 CVE-2026-21714 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants so consecutive numeric strings no longer collide in V8's internal string table (HashDoS via JSON.parse) Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants, so consecutive numeric strings no longer collide in V8's internal string table Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants, so consecutive numeric strings no longer collide in V8's internal string table Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2023-30581: policy: handle mainModule.__proto__ bypass by installing the policy-aware require() on the module prototype and assigning process.mainModule via setOwnProperty(), closing the process.mainModule.__proto__.require() experimental-policy bypass - CVE-2023-44487: nghttp2 (HTTP/2 Rapid Reset): backport the upstream nghttp2 1.57.0 RST_STREAM token-bucket rate limiter to the bundled nghttp2 1.42.0 (default burst=1000, rate=33/s); excessive incoming RST_STREAM frames now trigger a GOAWAY instead of unbounded work Important TuxCare License Agreement CVE-2023-30581 CVE-2023-44487 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2023-44487: HTTP/2 Rapid Reset. Backport the nghttp2 RST_STREAM rate-limit mitigation (token bucket, burst=1000 rate=33/s) to the bundled deps/nghttp2 1.47.0; once the per-connection budget is exhausted a GOAWAY is sent, tearing down peers that rapidly open and cancel HTTP/2 streams. Minimal cherry-pick of upstream nghttp2 commit 72b4af6143 (shipped in 1.57.0), no wholesale version bump Important TuxCare License Agreement CVE-2023-44487 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes to prevent silent authority rebinding via C-string truncation in the resolver bindings (backport of nodejs/node@7dafafa2 adapted to 14.21.3: validateStringWithoutNullBytes) - CVE-2026-48619: http2: cap the client-side originSet size (default 128) so a malicious server can no longer cause unbounded memory growth via ORIGIN frames (backport of nodejs/node@c79968e1) - CVE-2026-48933: crypto: guard the cipher output-length computation against signed-int overflow in the legacy CipherBase::Update path in src/node_crypto.cc (Node 14 has no WebCrypto; adapted INT_MAX guard from nodejs/node@98fbc892) Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-48619: http2 client OOM via unbounded ORIGIN frames. Backport upstream c79968e108 (first in v22.23.0): cap the client-side originSet (default 128, configurable via options.maxOriginSetSize on connect) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS once exceeded. Node 16 is EOL, no upstream 16.x fix; vulnerable onOrigin() loop present. - CVE-2026-48930: TLS/DNS embedded-NUL hostname authority rebinding. Backport upstream 7dafafa242 (first in v22.23.0): add validateStringWithoutNullBytes() and reject embedded NUL bytes in the hostname/options.host arguments of dns.lookup, dnsPromises.lookup and net.connect before they reach the NUL-terminated C resolver. - CVE-2026-48933: WebCrypto AES cipher output-length integer overflow. Backport upstream 98fbc89211 (first in v22.23.0): add TryGetIntCipherOutputLength() guard in crypto_cipher.h and use it in AES_Cipher() so an input length near 2 GiB fails cleanly instead of overflowing the signed int buffer length and aborting the process. Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-48619: cap http2 client originSet size (default 128, option maxOriginSetSize) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS, preventing unbounded memory growth from malicious ORIGIN frames - CVE-2026-48930: reject dns/net hostnames containing embedded NUL bytes via new validateStringWithoutNullBytes, preventing silent authority rebinding from c-string truncation in the resolver bindings - CVE-2026-48933: guard the WebCrypto AES cipher output length with TryGetIntCipherOutputLength so ~2 GiB inputs fail cleanly instead of overflowing the signed int buffer length and aborting the process Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-48619: cap HTTP/2 client originSet size to prevent unbounded memory growth from malicious ORIGIN frames - CVE-2026-48930: reject dns/net hostnames with embedded NUL bytes to prevent silent authority rebinding via C-string truncation - CVE-2026-48933: guard WebCrypto cipher output length to avoid signed integer overflow on ~2 GiB inputs Critical TuxCare License Agreement CVE-2023-32003 CVE-2026-48933 CVE-2026-48930 CVE-2023-30582 CVE-2026-48619 CVE-2024-37372 CVE-2023-32005 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp 6.1.1 that Node compiles by default, so headers_almost_done, chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require the LF after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-48931 CVE-2026-48618 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-48617: gate process.report.writeReport() on the fs.write permission so diagnostic reports cannot escape the --allow-fs-write allow-list - CVE-2026-48935: disable FileHandle.utimes() when the Permission Model is enabled so file timestamps cannot be changed with read-only access Moderate TuxCare License Agreement CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-48618 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2023-39333: module: stop code injection through WebAssembly export names in lib/internal/modules/esm/create_dynamic_module.js -- the ESM facade now uses index-derived local bindings and a JSONStringify-quoted import.meta.exports key instead of interpolating the attacker-controlled export name into code position (adapted from nodejs/node@eaf9083c: V8 8.4 has no ES2022 arbitrary module namespace names, so the `export { ... as NAME }` clause is emitted only for names matching the IdentifierName grammar) - CVE-2026-48931: http: destroy keep-alive sockets that receive unsolicited data while idle in the Agent freeSockets pool, closing the response-queue poisoning window left open once responseKeepAlive() detaches the parser and its 'data' listener (backport of nodejs/node@0a22d401 squashed with its regression follow-up nodejs/node@eaa29254, which guards the idle socket at the handle level instead of attaching a public 'data' listener plus resume()) Low TuxCare License Agreement CVE-2026-48931 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2026-48937: http2: tear down the session when nghttp2 internally queues a GOAWAY for a low-level protocol error. nghttp2 calls nghttp2_session_terminate_session() itself and returns success from nghttp2_session_mem_recv() without any callback, so the Http2Session stayed live on a dead socket, holding its streams, buffers and handle -- repeatable by an unauthenticated peer for memory/handle exhaustion. OnFrameSent() now flags a GOAWAY we did not initiate and SendPendingData() raises NGHTTP2_ERR_PROTO to JavaScript after it is written (backport of nodejs/node@a8a0d128; Node 14 has no graceful_close_initiated_ flag, so that term of the guard is covered by the new goaway_initiated_ flag and by is_closing()) Low TuxCare License Agreement CVE-2026-48937 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp that Node compiles by default (the tarball's 6.0.11 is rebased to 6.1.1 by CVE-2024-22019 and CVE-2024-27982 earlier in this series), so headers_almost_done, chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require the LF after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 cpe:/o:centos:centos:10 Community Enterprise Operating System 10 - CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp 2.1.6 that Node compiles by default, so headers_almost_done, chunk_size_almost_done, the chunk_data_almost_done / chunk_data_almost_done_skip pair and res_line_almost_done require the LF (resp. CR then LF) after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 cpe:/o:centos:centos:10 alt-nodejs16-nodejs alt-nodejs16-nodejs-devel alt-nodejs16-nodejs-docs alt-nodejs16-npm alt-nodejs18-nodejs alt-nodejs18-nodejs-devel alt-nodejs18-nodejs-docs alt-nodejs18-npm alt-nodejs14-nodejs alt-nodejs14-nodejs-devel alt-nodejs14-nodejs-docs alt-nodejs14-npm alt-nodejs20-nodejs alt-nodejs20-nodejs-devel alt-nodejs20-nodejs-docs alt-nodejs20-npm x86_64 0:16.20.2-10.el10 d07bf2a08d50eb66 0:16.20.2-10.el10 x86_64 0:8.19.4-16.20.2.10.el10 x86_64 0:18.20.8-4.el10 0:18.20.8-4.el10 x86_64 0:10.8.2-18.20.8.4.el10 x86_64 0:14.21.3-16.el10 0:14.21.3-16.el10 x86_64 1:6.14.18-14.21.3.16.el10 x86_64 0:14.21.3-19.el10 0:14.21.3-19.el10 x86_64 1:6.14.18-14.21.3.19.el10 x86_64 0:16.20.2-12.el10 0:16.20.2-12.el10 x86_64 0:8.19.4-16.20.2.12.el10 x86_64 0:18.20.8-5.el10 0:18.20.8-5.el10 x86_64 0:10.8.2-18.20.8.5.el10 x86_64 0:16.20.2-17.el10 0:16.20.2-17.el10 x86_64 0:8.19.4-16.20.2.17.el10 x86_64 0:18.20.8-8.el10 0:18.20.8-8.el10 x86_64 0:10.8.2-18.20.8.8.el10 x86_64 0:14.21.3-20.el10 0:14.21.3-20.el10 x86_64 1:6.14.18-14.21.3.20.el10 x86_64 0:18.20.8-9.el10 0:18.20.8-9.el10 x86_64 0:10.8.2-18.20.8.9.el10 x86_64 0:16.20.2-18.el10 0:16.20.2-18.el10 x86_64 0:8.19.4-16.20.2.18.el10 x86_64 0:18.20.8-12.el10 0:18.20.8-12.el10 x86_64 0:10.8.2-18.20.8.12.el10 x86_64 0:14.21.3-21.el10 0:14.21.3-21.el10 x86_64 1:6.14.18-14.21.3.21.el10 x86_64 0:20.20.2-2.el10 0:20.20.2-2.el10 x86_64 0:10.8.2-20.20.2.2.el10 x86_64 0:16.20.2-20.el10 0:16.20.2-20.el10 x86_64 0:8.19.4-16.20.2.20.el10 x86_64 0:14.21.3-22.el10 0:14.21.3-22.el10 x86_64 1:6.14.18-14.21.3.22.el10 x86_64 0:16.20.2-21.el10 0:16.20.2-21.el10 x86_64 0:8.19.4-16.20.2.21.el10 x86_64 0:18.20.8-13.el10 0:18.20.8-13.el10 x86_64 0:10.8.2-18.20.8.13.el10 x86_64 0:14.21.3-23.el10 0:14.21.3-23.el10 x86_64 1:6.14.18-14.21.3.23.el10 x86_64 0:16.20.2-22.el10 0:16.20.2-22.el10 x86_64 0:8.19.4-16.20.2.22.el10 x86_64 0:14.21.3-24.el10 0:14.21.3-24.el10 x86_64 1:6.14.18-14.21.3.24.el10 x86_64 0:16.20.2-23.el10 0:16.20.2-23.el10 x86_64 0:8.19.4-16.20.2.23.el10 x86_64 0:18.20.8-14.el10 0:18.20.8-14.el10 x86_64 0:10.8.2-18.20.8.14.el10 x86_64 0:20.20.2-3.el10 0:20.20.2-3.el10 x86_64 0:10.8.2-20.20.2.3.el10 x86_64 0:18.20.8-17.el10 0:18.20.8-17.el10 x86_64 0:10.8.2-18.20.8.17.el10 x86_64 0:20.20.2-6.el10 0:20.20.2-6.el10 x86_64 0:10.8.2-20.20.2.6.el10 x86_64 0:14.21.3-25.el10 0:14.21.3-25.el10 x86_64 1:6.14.18-14.21.3.25.el10 x86_64 0:14.21.3-26.el10 0:14.21.3-26.el10 x86_64 1:6.14.18-14.21.3.26.el10 x86_64 0:16.20.2-24.el10 0:16.20.2-24.el10 x86_64 0:8.19.4-16.20.2.24.el10 x86_64 0:14.21.3-28.el10 0:14.21.3-28.el10 x86_64 1:6.14.18-14.21.3.28.el10