Tuxcare Errata System 0.0.1 5.10 2026-08-27T12:00:01 Community Enterprise Operating System 7 - CVE-2025-23166: fix incorrect ThrowException() call in background thread to prevent process crash Important TuxCare License Agreement CVE-2025-23166 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-23085: fix HTTP/2 memory leak on premature socket close or invalid header (ERR_PROTO) Important TuxCare License Agreement CVE-2025-23085 CVE-2024-27983 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2024-25629: fix ares__read_line() function to prevent out-of-bounds read when parsing configuration files with embedded NULL characters Important TuxCare License Agreement CVE-2025-23166 CVE-2024-25629 CVE-2024-28863 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits() that could lead to remote denial of service when malformed input is processed Important TuxCare License Agreement CVE-2024-22019 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2023-38552: use tamper-proof integrity check function to prevent tampering with Hash class internals in policy mechanism Important TuxCare License Agreement CVE-2023-38552 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - Fix build on CL7 Critical TuxCare License Agreement CVE-2023-38552 CVE-2023-32006 CVE-2023-30589 CVE-2023-32002 CVE-2023-32559 CVE-2023-30590 CVE-2024-25629 CVE-2024-28863 CVE-2025-23085 CVE-2024-27983 CVE-2024-22019 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2022-32212: fix IPv4 validation in inspector_socket to properly validate IP addresses and reject non-routable IPs (0.0.0.0/8), replace vulnerable dot-counting parser with proper octet validation, add tests Critical TuxCare License Agreement CVE-2025-23085 CVE-2023-30589 CVE-2023-32006 CVE-2023-32002 CVE-2023-32559 CVE-2023-30590 CVE-2024-28863 CVE-2023-23918 CVE-2024-25629 CVE-2022-32212 CVE-2024-27983 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2023-46809: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style padding‑oracle attack that could allow recovery of sensitive data. Moderate TuxCare License Agreement CVE-2023-46809 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2023-46809: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style padding‑oracle attack that could allow recovery of sensitive data. Moderate TuxCare License Agreement CVE-2023-46809 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2024-27982: disallow OBS folding in HTTP headers by default Moderate TuxCare License Agreement CVE-2024-27982 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2023-38552: use tamper-proof integrity check function to prevent tampering with Hash class internals in policy mechanism Important TuxCare License Agreement CVE-2023-38552 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2024-27982: disallow OBS folding in HTTP headers by default Moderate TuxCare License Agreement CVE-2024-27982 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits() that could lead to remote denial of service when malformed input is processed Important TuxCare License Agreement CVE-2024-22019 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2024-27982: disallow OBS folding in HTTP headers by default Moderate TuxCare License Agreement CVE-2022-32215 CVE-2022-35256 CVE-2022-32213 CVE-2022-32214 CVE-2024-27982 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource exhaustion during decompression Moderate TuxCare License Agreement CVE-2024-22025 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource exhaustion during decompression Moderate TuxCare License Agreement CVE-2024-22025 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource exhaustion during decompression Moderate TuxCare License Agreement CVE-2023-46809 CVE-2024-22025 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2023-45143: clear Cookie and Host headers on cross-origin redirects to prevent sensitive data leakage Low TuxCare License Agreement CVE-2023-45143 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - Enable shared OpenSSL Moderate TuxCare License Agreement CVE-2024-0727 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle mechanism that could expose uninitialized memory when using vm module with timeout options, preventing potential information disclosure Important TuxCare License Agreement CVE-2025-55131 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle mechanism that could expose uninitialized memory when using vm module with timeout options, preventing potential information disclosure Important TuxCare License Agreement CVE-2025-55131 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers Important TuxCare License Agreement CVE-2025-59466 CVE-2026-21637 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException Important TuxCare License Agreement CVE-2025-59466 CVE-2026-21637 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21637: wrap pskCallback and ALPNCallback invocations in try-catch blocks to route exceptions through error handlers - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException Important TuxCare License Agreement CVE-2026-21637 CVE-2025-59466 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle mechanism preventing race condition that could expose uninitialized memory Important TuxCare License Agreement CVE-2025-55131 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle mechanism preventing race condition that could expose uninitialized memory Important TuxCare License Agreement CVE-2025-55131 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers Important TuxCare License Agreement CVE-2026-21637 CVE-2025-59466 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-22150: undici uses predictable Math.random() for multipart/form-data boundary, allowing attackers to tamper with backend requests under certain conditions Moderate TuxCare License Agreement CVE-2025-22150 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21710: use null prototype for headersDistinct/trailersDistinct to prevent uncaught TypeError when a __proto__ header is received and the application accesses req.headersDistinct or req.trailersDistinct Important TuxCare License Agreement CVE-2026-21710 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21710: use null prototype for headersDistinct/trailersDistinct to prevent uncaught TypeError when a __proto__ header is received and the application accesses req.headersDistinct or req.trailersDistinct Important TuxCare License Agreement CVE-2026-21710 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21714 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21712: return original href when ada::parse fails in url.format() instead of crashing on malformed IDN hostnames Moderate TuxCare License Agreement CVE-2026-21712 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21714 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21713 CVE-2026-21714 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants so consecutive numeric strings no longer collide in V8's internal string table (HashDoS via JSON.parse) Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants, so consecutive numeric strings no longer collide in V8's internal string table Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants, so consecutive numeric strings no longer collide in V8's internal string table Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21717: scramble V8 array-index hash_field with a 3-round xorshift-multiply so consecutive numeric strings no longer hash to consecutive buckets, preventing O(n^2) HashDoS via JSON.parse Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2023-30581: policy: handle mainModule.__proto__ bypass by installing the policy-aware require() on the module prototype and assigning process.mainModule via setOwnProperty(), closing the process.mainModule.__proto__.require() experimental-policy bypass - CVE-2023-44487: nghttp2 (HTTP/2 Rapid Reset): backport the upstream nghttp2 1.57.0 RST_STREAM token-bucket rate limiter to the bundled nghttp2 1.42.0 (default burst=1000, rate=33/s); excessive incoming RST_STREAM frames now trigger a GOAWAY instead of unbounded work Important TuxCare License Agreement CVE-2023-30581 CVE-2023-44487 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2023-44487: HTTP/2 Rapid Reset. Backport the nghttp2 RST_STREAM rate-limit mitigation (token bucket, burst=1000 rate=33/s) to the bundled deps/nghttp2 1.47.0; once the per-connection budget is exhausted a GOAWAY is sent, tearing down peers that rapidly open and cancel HTTP/2 streams. Minimal cherry-pick of upstream nghttp2 commit 72b4af6143 (shipped in 1.57.0), no wholesale version bump Important TuxCare License Agreement CVE-2023-44487 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2023-30581: handle mainModule.__proto__ bypass of the experimental policy mechanism; set the policy-wrapped require on Module.prototype and use setOwnProperty for process.mainModule (backport of nodejs/node d0a8264ec9) - CVE-2023-44487: HTTP/2 Rapid Reset; backport the nghttp2 RST_STREAM rate-limit mitigation (token-bucket limiter, default burst 1000 / rate 33, GOAWAY on exhaustion) into bundled deps/nghttp2 (backport of nghttp2 72b4af6) Important TuxCare License Agreement CVE-2023-30581 CVE-2023-44487 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-48619: cap the HTTP/2 client originSet at 128 entries so a malicious server can no longer drive unbounded memory growth via repeated ORIGIN frames; the session is destroyed with ERR_HTTP2_TOO_MANY_ORIGINS once the cap is exceeded (backport of nodejs/node c79968e108) - CVE-2026-48930: reject dns.lookup()/dnsPromises.lookup()/net.connect() hostnames that contain an embedded NUL byte, preventing silent authority rebinding caused by C-string truncation in the resolver bindings; adds validateStringWithoutNullBytes (backport of nodejs/node 7dafafa2) - CVE-2026-48933: guard the legacy CipherBase::Update() output-length computation against signed-int overflow (len + block_size > INT_MAX), turning ~2 GiB one-shot cipher inputs into a clean failure instead of an out-of-bounds write; the legacy analog of the WebCrypto fix in nodejs/node 98fbc89211 (Node 12 has no WebCrypto) Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes to prevent silent authority rebinding via C-string truncation in the resolver bindings (backport of nodejs/node@7dafafa2 adapted to 14.21.3: validateStringWithoutNullBytes) - CVE-2026-48619: http2: cap the client-side originSet size (default 128) so a malicious server can no longer cause unbounded memory growth via ORIGIN frames (backport of nodejs/node@c79968e1) - CVE-2026-48933: crypto: guard the cipher output-length computation against signed-int overflow in the legacy CipherBase::Update path in src/node_crypto.cc (Node 14 has no WebCrypto; adapted INT_MAX guard from nodejs/node@98fbc892) Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-48619: cap http2 client originSet size (default 128, option maxOriginSetSize) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS, preventing unbounded memory growth from malicious ORIGIN frames - CVE-2026-48930: reject dns/net hostnames containing embedded NUL bytes via new validateStringWithoutNullBytes, preventing silent authority rebinding from c-string truncation in the resolver bindings - CVE-2026-48933: guard the WebCrypto AES cipher output length with TryGetIntCipherOutputLength so ~2 GiB inputs fail cleanly instead of overflowing the signed int buffer length and aborting the process Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-48619: http2 client OOM via unbounded ORIGIN frames. Backport upstream c79968e108 (first in v22.23.0): cap the client-side originSet (default 128, configurable via options.maxOriginSetSize on connect) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS once exceeded. Node 16 is EOL, no upstream 16.x fix; vulnerable onOrigin() loop present. - CVE-2026-48930: TLS/DNS embedded-NUL hostname authority rebinding. Backport upstream 7dafafa242 (first in v22.23.0): add validateStringWithoutNullBytes() and reject embedded NUL bytes in the hostname/options.host arguments of dns.lookup, dnsPromises.lookup and net.connect before they reach the NUL-terminated C resolver. - CVE-2026-48933: WebCrypto AES cipher output-length integer overflow. Backport upstream 98fbc89211 (first in v22.23.0): add TryGetIntCipherOutputLength() guard in crypto_cipher.h and use it in AES_Cipher() so an input length near 2 GiB fails cleanly instead of overflowing the signed int buffer length and aborting the process. Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-48619: cap HTTP/2 client originSet size to prevent unbounded memory growth from malicious ORIGIN frames - CVE-2026-48930: reject dns/net hostnames with embedded NUL bytes to prevent silent authority rebinding via C-string truncation - CVE-2026-48933: guard WebCrypto cipher output length to avoid signed integer overflow on ~2 GiB inputs Critical TuxCare License Agreement CVE-2023-32003 CVE-2026-48933 CVE-2026-48930 CVE-2023-30582 CVE-2026-48619 CVE-2024-37372 CVE-2023-32005 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-48617: gate process.report.writeReport() on the fs.write permission so diagnostic reports cannot escape the --allow-fs-write allow-list - CVE-2026-48935: disable FileHandle.utimes() when the Permission Model is enabled so file timestamps cannot be changed with read-only access Moderate TuxCare License Agreement CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-48618 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp 6.1.1 that Node compiles by default, so headers_almost_done, chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require the LF after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-48931 CVE-2026-48618 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2023-39333: module: stop code injection through WebAssembly export names in lib/internal/modules/esm/create_dynamic_module.js -- the ESM facade now uses index-derived local bindings and a JSONStringify-quoted import.meta.exports key instead of interpolating the attacker-controlled export name into code position (adapted from nodejs/node@eaf9083c: V8 8.4 has no ES2022 arbitrary module namespace names, so the `export { ... as NAME }` clause is emitted only for names matching the IdentifierName grammar) - CVE-2026-48931: http: destroy keep-alive sockets that receive unsolicited data while idle in the Agent freeSockets pool, closing the response-queue poisoning window left open once responseKeepAlive() detaches the parser and its 'data' listener (backport of nodejs/node@0a22d401 squashed with its regression follow-up nodejs/node@eaa29254, which guards the idle socket at the handle level instead of attaching a public 'data' listener plus resume()) Low TuxCare License Agreement CVE-2026-48931 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-48937: http2: tear down the session when nghttp2 internally queues a GOAWAY for a low-level protocol error. nghttp2 calls nghttp2_session_terminate_session() itself and returns success from nghttp2_session_mem_recv() without any callback, so the Http2Session stayed live on a dead socket, holding its streams, buffers and handle -- repeatable by an unauthenticated peer for memory/handle exhaustion. OnFrameSent() now flags a GOAWAY we did not initiate and SendPendingData() raises NGHTTP2_ERR_PROTO to JavaScript after it is written (backport of nodejs/node@a8a0d128; Node 14 has no graceful_close_initiated_ flag, so that term of the guard is covered by the new goaway_initiated_ flag and by is_closing()) Low TuxCare License Agreement CVE-2026-48937 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-48618: normalize the peer hostname with domainToASCII() before splitting it into DNS labels in tls.checkServerIdentity(), so the verifier counts the same labels the resolver connected to; Unicode dot separators (U+3002, U+FF0E, U+FF61) can no longer defeat the wildcard-depth rule and make a *.example.com certificate authenticate a host two levels below it (backport of nodejs/node 1efb4ff51a plus the required IPv6 IP-SAN follow-up 1d87a24050) - CVE-2026-48928: add the 'i' flag to the SNI RegExp built by tls.Server.prototype.addContext(), so an uppercase or mixed-case SNI hostname selects its per-hostname SecureContext instead of silently falling back to the server's default context and bypassing per-tenant client-certificate authorization in multi-context mTLS deployments (backport of nodejs/node 39d1d09684) - CVE-2026-48934: bind a reusable TLS client session to the host it was authenticated for, so a session obtained from host A can no longer be replayed against host B to skip checkServerIdentity() via isSessionReused(); adds wrapSessionState/getSessionForReuse and an explicit TLSSocket.prototype.getSession (backport of nodejs/node fd890ba01d, with the fix's optional chaining rewritten to && form because V8 7.8 has no ?.) - CVE-2026-58040: bind identity checks to session and socket reuse in the https.Agent, the vector CVE-2026-48934 left open. A request supplying its own checkServerIdentity is tagged with a unique per-request index that Agent.prototype.getName() appends, so it gets its own pool bucket; createConnection() neither reads nor writes the TLS session cache for it, and a new keepSocketAlive() override keeps its socket out of freeSockets. A later request using the default strict check can therefore no longer inherit a session or a keep-alive socket authenticated under permissive rules and be reported authorized against an unverified host (backport of nodejs/node 51123159fe) Important TuxCare License Agreement CVE-2026-48937 CVE-2026-48931 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21713 CVE-2026-21714 CVE-2026-21712 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp that Node compiles by default (the tarball's 6.0.11 is rebased to 6.1.1 by CVE-2024-22019 and CVE-2024-27982 earlier in this series), so headers_almost_done, chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require the LF after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-23167: restore HTTP/1 message-framing terminator validation in both parsers Node 12 bundles. In the loose (non-strict) state machine of llhttp 2.1.6 -- the one Node compiles, since LLHTTP_STRICT_MODE is never set -- headers_almost_done, chunk_size_almost_done and the chunk_data_almost_done / chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after a CR instead of consuming any byte, and res_line_almost_done requires the LF after the response status line's CR. The legacy deps/http_parser 2.9.4, which node.gypi also links and which --http-parser=legacy (or NODE_OPTIONS) selects at runtime, is built with HTTP_PARSER_STRICT=0 and had the identical defect; its five framing assertions are made unconditional via a new FRAMING_CHECK macro. A header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT instead of swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 cpe:/o:centos:centos:7 Community Enterprise Operating System 7 - CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp 2.1.6 that Node compiles by default, so headers_almost_done, chunk_size_almost_done, the chunk_data_almost_done / chunk_data_almost_done_skip pair and res_line_almost_done require the LF (resp. CR then LF) after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 cpe:/o:centos:centos:7 alt-nodejs18-nodejs alt-nodejs18-nodejs-devel alt-nodejs18-nodejs-docs alt-nodejs18-npm alt-nodejs16-nodejs alt-nodejs16-nodejs-devel alt-nodejs16-nodejs-docs alt-nodejs16-npm alt-nodejs14-nodejs alt-nodejs14-nodejs-devel alt-nodejs14-nodejs-docs alt-nodejs14-npm alt-nodejs12-nodejs alt-nodejs12-nodejs-devel alt-nodejs12-nodejs-docs alt-nodejs12-npm alt-nodejs20-nodejs alt-nodejs20-nodejs-devel alt-nodejs20-nodejs-docs alt-nodejs20-npm x86_64 0:18.20.8-2.el7.tuxcare.els1 d07bf2a08d50eb66 0:18.20.8-2.el7.tuxcare.els1 x86_64 0:10.8.2-18.20.8.2.el7 x86_64 0:16.20.2-1.el7.tuxcare.els2 0:16.20.2-1.el7.tuxcare.els2 x86_64 0:8.19.4-16.20.2.1.el7 x86_64 0:16.20.2-1.el7.tuxcare.els5 0:16.20.2-1.el7.tuxcare.els5 x86_64 0:16.20.2-2.el7.tuxcare.els6 0:16.20.2-2.el7.tuxcare.els6 x86_64 0:8.19.4-16.20.2.2.el7 x86_64 0:16.20.2-3.el7 0:16.20.2-3.el7 x86_64 0:8.19.4-16.20.2.3.el7 x86_64 0:14.21.3-10.el7 0:14.21.3-10.el7 x86_64 0:6.14.18-14.21.3.10.el7 x86_64 0:12.22.12-7.el7 0:12.22.12-7.el7 x86_64 0:14.21.3-11.el7 0:14.21.3-11.el7 x86_64 0:6.14.18-14.21.3.11.el7 x86_64 0:16.20.2-4.el7 0:16.20.2-4.el7 x86_64 0:8.19.4-16.20.2.4.el7 x86_64 0:14.21.3-12.el7 0:14.21.3-12.el7 x86_64 0:6.14.18-14.21.3.12.el7 x86_64 0:12.22.12-8.el7 0:12.22.12-8.el7 x86_64 1:6.14.16-12.22.12.8.el7 x86_64 0:16.20.2-5.el7 0:16.20.2-5.el7 x86_64 0:8.19.4-16.20.2.5.el7 x86_64 0:12.22.12-10.el7 0:12.22.12-10.el7 x86_64 1:6.14.16-12.22.12.10.el7 x86_64 0:12.22.12-12.el7 0:12.22.12-12.el7 x86_64 1:6.14.16-12.22.12.12.el7 x86_64 0:14.21.3-14.el7 0:14.21.3-14.el7 x86_64 0:6.14.18-14.21.3.14.el7 x86_64 0:16.20.2-7.el7 0:16.20.2-7.el7 x86_64 0:8.19.4-16.20.2.7.el7 x86_64 0:12.22.12-14.el7 0:12.22.12-14.el7 x86_64 1:6.14.16-12.22.12.14.el7 x86_64 0:16.20.2-8.el7 0:16.20.2-8.el7 x86_64 0:8.19.4-16.20.2.8.el7 x86_64 0:16.20.2-9.el7 0:16.20.2-9.el7 x86_64 0:8.19.4-16.20.2.9.el7 x86_64 0:16.20.2-10.el7 0:16.20.2-10.el7 x86_64 0:8.19.4-16.20.2.10.el7 x86_64 0:14.21.3-17.el7 0:14.21.3-17.el7 x86_64 1:6.14.18-14.21.3.17.el7 x86_64 0:18.20.8-4.el7 0:18.20.8-4.el7 x86_64 0:10.8.2-18.20.8.4.el7 x86_64 0:14.21.3-18.el7 0:14.21.3-18.el7 x86_64 1:6.14.18-14.21.3.18.el7 x86_64 0:12.22.12-15.el7 0:12.22.12-15.el7 x86_64 1:6.14.16-12.22.12.15.el7 x86_64 0:12.22.12-16.el7 0:12.22.12-16.el7 x86_64 1:6.14.16-12.22.12.16.el7 x86_64 0:14.21.3-19.el7 0:14.21.3-19.el7 x86_64 1:6.14.18-14.21.3.19.el7 x86_64 0:16.20.2-12.el7 0:16.20.2-12.el7 x86_64 0:8.19.4-16.20.2.12.el7 x86_64 0:18.20.8-5.el7 0:18.20.8-5.el7 x86_64 0:10.8.2-18.20.8.5.el7 x86_64 0:16.20.2-13.el7 0:16.20.2-13.el7 x86_64 0:8.19.4-16.20.2.13.el7 x86_64 0:18.20.8-6.el7 0:18.20.8-6.el7 x86_64 0:10.8.2-18.20.8.6.el7 x86_64 0:12.22.12-17.el7 0:12.22.12-17.el7 x86_64 1:6.14.16-12.22.12.17.el7 x86_64 0:16.20.2-17.el7 0:16.20.2-17.el7 x86_64 0:8.19.4-16.20.2.17.el7 x86_64 0:18.20.8-9.el7 0:18.20.8-9.el7 x86_64 0:10.8.2-18.20.8.9.el7 x86_64 0:16.20.2-18.el7 0:16.20.2-18.el7 x86_64 0:8.19.4-16.20.2.18.el7 x86_64 0:14.21.3-21.el7 0:14.21.3-21.el7 x86_64 1:6.14.18-14.21.3.21.el7 x86_64 0:20.20.2-2.el7 0:20.20.2-2.el7 x86_64 0:10.8.2-20.20.2.2.el7 x86_64 0:12.22.12-19.el7 0:12.22.12-19.el7 x86_64 1:6.14.16-12.22.12.19.el7 x86_64 0:16.20.2-20.el7 0:16.20.2-20.el7 x86_64 0:8.19.4-16.20.2.20.el7 x86_64 0:14.21.3-22.el7 0:14.21.3-22.el7 x86_64 1:6.14.18-14.21.3.22.el7 x86_64 0:16.20.2-21.el7 0:16.20.2-21.el7 x86_64 0:8.19.4-16.20.2.21.el7 x86_64 0:18.20.8-13.el7 0:18.20.8-13.el7 x86_64 0:10.8.2-18.20.8.13.el7 x86_64 0:12.22.12-20.el7 0:12.22.12-20.el7 x86_64 1:6.14.16-12.22.12.20.el7 x86_64 0:14.21.3-23.el7 0:14.21.3-23.el7 x86_64 1:6.14.18-14.21.3.23.el7 x86_64 0:16.20.2-22.el7 0:16.20.2-22.el7 x86_64 0:8.19.4-16.20.2.22.el7 x86_64 0:12.22.12-21.el7 0:12.22.12-21.el7 x86_64 1:6.14.16-12.22.12.21.el7 x86_64 0:12.22.12-22.el7 0:12.22.12-22.el7 x86_64 1:6.14.16-12.22.12.22.el7 x86_64 0:14.21.3-24.el7 0:14.21.3-24.el7 x86_64 1:6.14.18-14.21.3.24.el7 x86_64 0:18.20.8-14.el7 0:18.20.8-14.el7 x86_64 0:10.8.2-18.20.8.14.el7 x86_64 0:16.20.2-23.el7 0:16.20.2-23.el7 x86_64 0:8.19.4-16.20.2.23.el7 x86_64 0:20.20.2-3.el7 0:20.20.2-3.el7 x86_64 0:10.8.2-20.20.2.3.el7 x86_64 0:20.20.2-6.el7 0:20.20.2-6.el7 x86_64 0:10.8.2-20.20.2.6.el7 x86_64 0:18.20.8-17.el7 0:18.20.8-17.el7 x86_64 0:10.8.2-18.20.8.17.el7 x86_64 0:14.21.3-25.el7 0:14.21.3-25.el7 x86_64 1:6.14.18-14.21.3.25.el7 x86_64 0:14.21.3-26.el7 0:14.21.3-26.el7 x86_64 1:6.14.18-14.21.3.26.el7 x86_64 0:12.22.12-24.el7 0:12.22.12-24.el7 x86_64 1:6.14.16-12.22.12.24.el7 x86_64 0:18.20.8-12.el7 0:18.20.8-12.el7 x86_64 0:10.8.2-18.20.8.12.el7 x86_64 0:16.20.2-24.el7 0:16.20.2-24.el7 x86_64 0:8.19.4-16.20.2.24.el7 x86_64 0:12.22.12-26.el7 0:12.22.12-26.el7 x86_64 1:6.14.16-12.22.12.26.el7 x86_64 0:14.21.3-28.el7 0:14.21.3-28.el7 x86_64 1:6.14.18-14.21.3.28.el7