Tuxcare Errata System 0.0.1 5.10 2026-08-27T12:39:51 Community Enterprise Operating System 8 - CVE-2025-23085: fix HTTP/2 memory leak on premature socket close or invalid header (ERR_PROTO) Important TuxCare License Agreement CVE-2024-27983 CVE-2025-23085 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2024-27983: close HTTP/2 streams during session destruction to prevent memory leak and DoS Important TuxCare License Agreement CVE-2024-27983 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2024-25629: fix ares__read_line() function to prevent out-of-bounds read when parsing configuration files with embedded NULL characters Important TuxCare License Agreement CVE-2024-28863 CVE-2025-23166 CVE-2024-25629 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2024-25629: fix ares__read_line() function to prevent out-of-bounds read when parsing configuration files with embedded NULL characters Moderate TuxCare License Agreement CVE-2024-25629 CVE-2025-23085 CVE-2024-28863 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-32002: prevent Module.constructor._load() bypass by adding constructor property protection - CVE-2023-32006: prevent require.main.constructor and require.extensions bypass by implementing secure module loading validation Critical TuxCare License Agreement CVE-2023-32006 CVE-2023-32002 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits() that could lead to remote denial of service when malformed input is processed Important TuxCare License Agreement CVE-2024-22019 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits() that could lead to remote denial of service when malformed input is processed Important TuxCare License Agreement CVE-2024-22019 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-30590: update documentation and add tests clarifying DH generateKeys behavior Important TuxCare License Agreement CVE-2023-30590 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-30589: fix llhttp parser to properly validate LF after CR in HTTP header fields, add lenient flag checks before allowing CR without LF, add test file to verify the fix prevents request smuggling attacks Important TuxCare License Agreement CVE-2023-32559 CVE-2023-30589 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-38552: use tamper-proof integrity check function to prevent tampering with Hash class internals in policy mechanism Important TuxCare License Agreement CVE-2023-38552 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-38552: use tamper-proof integrity check function to prevent tampering with Hash class internals in policy mechanism Important TuxCare License Agreement CVE-2023-38552 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2022-32212: fix IPv4 validation in inspector_socket to properly validate IP addresses and reject non-routable IPs (0.0.0.0/8), replace vulnerable dot-counting parser with proper octet validation, add tests Critical TuxCare License Agreement CVE-2022-32212 CVE-2023-23918 CVE-2023-30589 CVE-2023-32006 CVE-2023-32002 CVE-2023-32559 CVE-2023-30590 CVE-2024-25629 CVE-2024-28863 CVE-2025-23085 CVE-2024-27983 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-46809: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style padding‑oracle attack that could allow recovery of sensitive data. Moderate TuxCare License Agreement CVE-2023-46809 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - ALTNJS-219: Remove gyp. Build for CL10 Important TuxCare License Agreement CVE-2025-23166 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-46809: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style padding‑oracle attack that could allow recovery of sensitive data. Moderate TuxCare License Agreement CVE-2023-46809 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2024-27982: disallow OBS folding in HTTP headers by default Moderate TuxCare License Agreement CVE-2024-27982 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-38552: use tamper-proof integrity check function to prevent tampering with Hash class internals in policy mechanism Important TuxCare License Agreement CVE-2023-38552 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2024-27982: disallow OBS folding in HTTP headers by default Moderate TuxCare License Agreement CVE-2024-27982 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits() that could lead to remote denial of service when malformed input is processed Important TuxCare License Agreement CVE-2024-22019 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2024-27982: disallow OBS folding in HTTP headers by default Moderate TuxCare License Agreement CVE-2022-32215 CVE-2022-32213 CVE-2022-32214 CVE-2022-35256 CVE-2024-27982 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource exhaustion during decompression Moderate TuxCare License Agreement CVE-2024-22025 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource exhaustion during decompression Moderate TuxCare License Agreement CVE-2024-22025 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource exhaustion during decompression Moderate TuxCare License Agreement CVE-2024-22025 CVE-2023-46809 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-45143: clear Cookie and Host headers on cross-origin redirects to prevent sensitive data leakage Low TuxCare License Agreement CVE-2023-45143 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - Enable shared OpenSSL Moderate TuxCare License Agreement CVE-2024-0727 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle mechanism that could expose uninitialized memory when using vm module with timeout options, preventing potential information disclosure Important TuxCare License Agreement CVE-2025-55131 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle mechanism that could expose uninitialized memory when using vm module with timeout options, preventing potential information disclosure Important TuxCare License Agreement CVE-2025-55131 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers Important TuxCare License Agreement CVE-2026-21637 CVE-2025-59466 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException Important TuxCare License Agreement CVE-2025-59466 CVE-2026-21637 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21637: wrap pskCallback and ALPNCallback invocations in try-catch blocks to route exceptions through error handlers - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException Important TuxCare License Agreement CVE-2025-59466 CVE-2026-21637 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle mechanism preventing race condition that could expose uninitialized memory Important TuxCare License Agreement CVE-2025-55131 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle mechanism preventing race condition that could expose uninitialized memory Important TuxCare License Agreement CVE-2025-55131 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers Important TuxCare License Agreement CVE-2026-21637 CVE-2025-59466 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-22150: undici uses predictable Math.random() for multipart/form-data boundary, allowing attackers to tamper with backend requests under certain conditions Moderate TuxCare License Agreement CVE-2025-22150 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21710: use null prototype for headersDistinct/trailersDistinct to prevent uncaught TypeError when a __proto__ header is received and the application accesses req.headersDistinct or req.trailersDistinct Important TuxCare License Agreement CVE-2026-21710 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21710: use null prototype for headersDistinct/trailersDistinct to prevent uncaught TypeError when a __proto__ header is received and the application accesses req.headersDistinct or req.trailersDistinct Important TuxCare License Agreement CVE-2026-21710 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21714 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21712: return original href when ada::parse fails in url.format() instead of crashing on malformed IDN hostnames Moderate TuxCare License Agreement CVE-2026-21712 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21714 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21713 CVE-2026-21714 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants so consecutive numeric strings no longer collide in V8's internal string table (HashDoS via JSON.parse) Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants, so consecutive numeric strings no longer collide in V8's internal string table Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants, so consecutive numeric strings no longer collide in V8's internal string table Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21717: scramble V8 array-index hash_field with a 3-round xorshift-multiply so consecutive numeric strings no longer hash to consecutive buckets, preventing O(n^2) HashDoS via JSON.parse Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-30581: policy: handle mainModule.__proto__ bypass by installing the policy-aware require() on the module prototype and assigning process.mainModule via setOwnProperty(), closing the process.mainModule.__proto__.require() experimental-policy bypass - CVE-2023-44487: nghttp2 (HTTP/2 Rapid Reset): backport the upstream nghttp2 1.57.0 RST_STREAM token-bucket rate limiter to the bundled nghttp2 1.42.0 (default burst=1000, rate=33/s); excessive incoming RST_STREAM frames now trigger a GOAWAY instead of unbounded work Important TuxCare License Agreement CVE-2023-30581 CVE-2023-44487 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-44487: HTTP/2 Rapid Reset. Backport the nghttp2 RST_STREAM rate-limit mitigation (token bucket, burst=1000 rate=33/s) to the bundled deps/nghttp2 1.47.0; once the per-connection budget is exhausted a GOAWAY is sent, tearing down peers that rapidly open and cancel HTTP/2 streams. Minimal cherry-pick of upstream nghttp2 commit 72b4af6143 (shipped in 1.57.0), no wholesale version bump Important TuxCare License Agreement CVE-2023-44487 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-30581: handle mainModule.__proto__ bypass of the experimental policy mechanism; set the policy-wrapped require on Module.prototype and use setOwnProperty for process.mainModule (backport of nodejs/node d0a8264ec9) - CVE-2023-44487: HTTP/2 Rapid Reset; backport the nghttp2 RST_STREAM rate-limit mitigation (token-bucket limiter, default burst 1000 / rate 33, GOAWAY on exhaustion) into bundled deps/nghttp2 (backport of nghttp2 72b4af6) Important TuxCare License Agreement CVE-2023-30581 CVE-2023-44487 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-48619: cap the HTTP/2 client originSet at 128 entries so a malicious server can no longer drive unbounded memory growth via repeated ORIGIN frames; the session is destroyed with ERR_HTTP2_TOO_MANY_ORIGINS once the cap is exceeded (backport of nodejs/node c79968e108) - CVE-2026-48930: reject dns.lookup()/dnsPromises.lookup()/net.connect() hostnames that contain an embedded NUL byte, preventing silent authority rebinding caused by C-string truncation in the resolver bindings; adds validateStringWithoutNullBytes (backport of nodejs/node 7dafafa2) - CVE-2026-48933: guard the legacy CipherBase::Update() output-length computation against signed-int overflow (len + block_size > INT_MAX), turning ~2 GiB one-shot cipher inputs into a clean failure instead of an out-of-bounds write; the legacy analog of the WebCrypto fix in nodejs/node 98fbc89211 (Node 12 has no WebCrypto) Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes to prevent silent authority rebinding via C-string truncation in the resolver bindings (backport of nodejs/node@7dafafa2 adapted to 14.21.3: validateStringWithoutNullBytes) - CVE-2026-48619: http2: cap the client-side originSet size (default 128) so a malicious server can no longer cause unbounded memory growth via ORIGIN frames (backport of nodejs/node@c79968e1) - CVE-2026-48933: crypto: guard the cipher output-length computation against signed-int overflow in the legacy CipherBase::Update path in src/node_crypto.cc (Node 14 has no WebCrypto; adapted INT_MAX guard from nodejs/node@98fbc892) Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-48619: http2 client OOM via unbounded ORIGIN frames. Backport upstream c79968e108 (first in v22.23.0): cap the client-side originSet (default 128, configurable via options.maxOriginSetSize on connect) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS once exceeded. Node 16 is EOL, no upstream 16.x fix; vulnerable onOrigin() loop present. - CVE-2026-48930: TLS/DNS embedded-NUL hostname authority rebinding. Backport upstream 7dafafa242 (first in v22.23.0): add validateStringWithoutNullBytes() and reject embedded NUL bytes in the hostname/options.host arguments of dns.lookup, dnsPromises.lookup and net.connect before they reach the NUL-terminated C resolver. - CVE-2026-48933: WebCrypto AES cipher output-length integer overflow. Backport upstream 98fbc89211 (first in v22.23.0): add TryGetIntCipherOutputLength() guard in crypto_cipher.h and use it in AES_Cipher() so an input length near 2 GiB fails cleanly instead of overflowing the signed int buffer length and aborting the process. Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-48619: cap http2 client originSet size (default 128, option maxOriginSetSize) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS, preventing unbounded memory growth from malicious ORIGIN frames - CVE-2026-48930: reject dns/net hostnames containing embedded NUL bytes via new validateStringWithoutNullBytes, preventing silent authority rebinding from c-string truncation in the resolver bindings - CVE-2026-48933: guard the WebCrypto AES cipher output length with TryGetIntCipherOutputLength so ~2 GiB inputs fail cleanly instead of overflowing the signed int buffer length and aborting the process Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-48619: cap HTTP/2 client originSet size to prevent unbounded memory growth from malicious ORIGIN frames - CVE-2026-48930: reject dns/net hostnames with embedded NUL bytes to prevent silent authority rebinding via C-string truncation - CVE-2026-48933: guard WebCrypto cipher output length to avoid signed integer overflow on ~2 GiB inputs Critical TuxCare License Agreement CVE-2023-32003 CVE-2026-48933 CVE-2026-48930 CVE-2023-30582 CVE-2026-48619 CVE-2024-37372 CVE-2023-32005 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp 6.1.1 that Node compiles by default, so headers_almost_done, chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require the LF after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-48931 CVE-2026-48618 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-48617: gate process.report.writeReport() on the fs.write permission so diagnostic reports cannot escape the --allow-fs-write allow-list - CVE-2026-48935: disable FileHandle.utimes() when the Permission Model is enabled so file timestamps cannot be changed with read-only access Moderate TuxCare License Agreement CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-48618 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2023-39333: module: stop code injection through WebAssembly export names in lib/internal/modules/esm/create_dynamic_module.js -- the ESM facade now uses index-derived local bindings and a JSONStringify-quoted import.meta.exports key instead of interpolating the attacker-controlled export name into code position (adapted from nodejs/node@eaf9083c: V8 8.4 has no ES2022 arbitrary module namespace names, so the `export { ... as NAME }` clause is emitted only for names matching the IdentifierName grammar) - CVE-2026-48931: http: destroy keep-alive sockets that receive unsolicited data while idle in the Agent freeSockets pool, closing the response-queue poisoning window left open once responseKeepAlive() detaches the parser and its 'data' listener (backport of nodejs/node@0a22d401 squashed with its regression follow-up nodejs/node@eaa29254, which guards the idle socket at the handle level instead of attaching a public 'data' listener plus resume()) Low TuxCare License Agreement CVE-2026-48931 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-48937: http2: tear down the session when nghttp2 internally queues a GOAWAY for a low-level protocol error. nghttp2 calls nghttp2_session_terminate_session() itself and returns success from nghttp2_session_mem_recv() without any callback, so the Http2Session stayed live on a dead socket, holding its streams, buffers and handle -- repeatable by an unauthenticated peer for memory/handle exhaustion. OnFrameSent() now flags a GOAWAY we did not initiate and SendPendingData() raises NGHTTP2_ERR_PROTO to JavaScript after it is written (backport of nodejs/node@a8a0d128; Node 14 has no graceful_close_initiated_ flag, so that term of the guard is covered by the new goaway_initiated_ flag and by is_closing()) Low TuxCare License Agreement CVE-2026-48937 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-48618: normalize the peer hostname with domainToASCII() before splitting it into DNS labels in tls.checkServerIdentity(), so the verifier counts the same labels the resolver connected to; Unicode dot separators (U+3002, U+FF0E, U+FF61) can no longer defeat the wildcard-depth rule and make a *.example.com certificate authenticate a host two levels below it (backport of nodejs/node 1efb4ff51a plus the required IPv6 IP-SAN follow-up 1d87a24050) - CVE-2026-48928: add the 'i' flag to the SNI RegExp built by tls.Server.prototype.addContext(), so an uppercase or mixed-case SNI hostname selects its per-hostname SecureContext instead of silently falling back to the server's default context and bypassing per-tenant client-certificate authorization in multi-context mTLS deployments (backport of nodejs/node 39d1d09684) - CVE-2026-48934: bind a reusable TLS client session to the host it was authenticated for, so a session obtained from host A can no longer be replayed against host B to skip checkServerIdentity() via isSessionReused(); adds wrapSessionState/getSessionForReuse and an explicit TLSSocket.prototype.getSession (backport of nodejs/node fd890ba01d, with the fix's optional chaining rewritten to && form because V8 7.8 has no ?.) - CVE-2026-58040: bind identity checks to session and socket reuse in the https.Agent, the vector CVE-2026-48934 left open. A request supplying its own checkServerIdentity is tagged with a unique per-request index that Agent.prototype.getName() appends, so it gets its own pool bucket; createConnection() neither reads nor writes the TLS session cache for it, and a new keepSocketAlive() override keeps its socket out of freeSockets. A later request using the default strict check can therefore no longer inherit a session or a keep-alive socket authenticated under permissive rules and be reported authorized against an unverified host (backport of nodejs/node 51123159fe) Important TuxCare License Agreement CVE-2026-48937 CVE-2026-48931 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21713 CVE-2026-21714 CVE-2026-21712 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp that Node compiles by default (the tarball's 6.0.11 is rebased to 6.1.1 by CVE-2024-22019 and CVE-2024-27982 earlier in this series), so headers_almost_done, chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require the LF after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-23167: restore HTTP/1 message-framing terminator validation in both parsers Node 12 bundles. In the loose (non-strict) state machine of llhttp 2.1.6 -- the one Node compiles, since LLHTTP_STRICT_MODE is never set -- headers_almost_done, chunk_size_almost_done and the chunk_data_almost_done / chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after a CR instead of consuming any byte, and res_line_almost_done requires the LF after the response status line's CR. The legacy deps/http_parser 2.9.4, which node.gypi also links and which --http-parser=legacy (or NODE_OPTIONS) selects at runtime, is built with HTTP_PARSER_STRICT=0 and had the identical defect; its five framing assertions are made unconditional via a new FRAMING_CHECK macro. A header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT instead of swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 cpe:/o:centos:centos:8 Community Enterprise Operating System 8 - CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp 2.1.6 that Node compiles by default, so headers_almost_done, chunk_size_almost_done, the chunk_data_almost_done / chunk_data_almost_done_skip pair and res_line_almost_done require the LF (resp. CR then LF) after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 cpe:/o:centos:centos:8 alt-nodejs16-nodejs alt-nodejs16-nodejs-devel alt-nodejs16-nodejs-docs alt-nodejs16-npm alt-nodejs14-nodejs alt-nodejs14-nodejs-devel alt-nodejs14-nodejs-docs alt-nodejs14-npm alt-nodejs12-nodejs alt-nodejs12-nodejs-devel alt-nodejs12-nodejs-docs alt-nodejs12-npm alt-nodejs18-nodejs alt-nodejs18-nodejs-devel alt-nodejs18-nodejs-docs alt-nodejs18-npm alt-nodejs20-nodejs alt-nodejs20-nodejs-devel alt-nodejs20-nodejs-docs alt-nodejs20-npm x86_64 0:16.20.2-1.el8.tuxcare.els2 d07bf2a08d50eb66 0:16.20.2-1.el8.tuxcare.els2 x86_64 0:8.19.4-16.20.2.1.el8 x86_64 0:14.21.3-1.1.el8.tuxcare.els1 0:14.21.3-1.1.el8.tuxcare.els1 x86_64 0:6.14.18-14.21.3.1.el8 x86_64 0:16.20.2-1.el8.tuxcare.els5 0:16.20.2-1.el8.tuxcare.els5 x86_64 0:14.21.3-1.1.el8.tuxcare.els4 0:14.21.3-1.1.el8.tuxcare.els4 x86_64 0:14.21.3-1.1.el8.tuxcare.els5 0:14.21.3-1.1.el8.tuxcare.els5 x86_64 0:16.20.2-2.el8.tuxcare.els6 0:16.20.2-2.el8.tuxcare.els6 x86_64 0:8.19.4-16.20.2.2.el8 x86_64 0:14.21.3-2.el8.tuxcare.els6 0:14.21.3-2.el8.tuxcare.els6 x86_64 0:6.14.18-14.21.3.2.el8 x86_64 0:14.21.3-3.el8 0:14.21.3-3.el8 x86_64 0:6.14.18-14.21.3.3.el8 x86_64 0:14.21.3-5.el8 0:14.21.3-5.el8 x86_64 0:6.14.18-14.21.3.5.el8 x86_64 0:16.20.2-3.el8 0:16.20.2-3.el8 x86_64 0:8.19.4-16.20.2.3.el8 x86_64 0:14.21.3-9.el8 0:14.21.3-9.el8 x86_64 0:6.14.18-14.21.3.9.el8 x86_64 0:12.22.12-7.el8 0:12.22.12-7.el8 x86_64 0:14.21.3-11.el8 0:14.21.3-11.el8 x86_64 0:6.14.18-14.21.3.11.el8 x86_64 0:18.20.8-3.el8.tuxcare.els 0:18.20.8-3.el8.tuxcare.els x86_64 0:10.8.2-18.20.8.3.el8 x86_64 0:16.20.2-4.el8 0:16.20.2-4.el8 x86_64 0:8.19.4-16.20.2.4.el8 x86_64 0:14.21.3-12.el8 0:14.21.3-12.el8 x86_64 0:6.14.18-14.21.3.12.el8 x86_64 0:12.22.12-8.el8 0:12.22.12-8.el8 x86_64 1:6.14.16-12.22.12.8.el8 x86_64 0:16.20.2-5.el8 0:16.20.2-5.el8 x86_64 0:8.19.4-16.20.2.5.el8 x86_64 0:12.22.12-10.el8 0:12.22.12-10.el8 x86_64 1:6.14.16-12.22.12.10.el8 x86_64 0:12.22.12-12.el8 0:12.22.12-12.el8 x86_64 1:6.14.16-12.22.12.12.el8 x86_64 0:14.21.3-14.el8 0:14.21.3-14.el8 x86_64 0:6.14.18-14.21.3.14.el8 x86_64 0:16.20.2-7.el8 0:16.20.2-7.el8 x86_64 0:8.19.4-16.20.2.7.el8 x86_64 0:12.22.12-14.el8 0:12.22.12-14.el8 x86_64 1:6.14.16-12.22.12.14.el8 x86_64 0:16.20.2-8.el8 0:16.20.2-8.el8 x86_64 0:8.19.4-16.20.2.8.el8 x86_64 0:16.20.2-9.el8 0:16.20.2-9.el8 x86_64 0:8.19.4-16.20.2.9.el8 x86_64 0:16.20.2-10.el8 0:16.20.2-10.el8 x86_64 0:8.19.4-16.20.2.10.el8 x86_64 0:14.21.3-17.el8 0:14.21.3-17.el8 x86_64 1:6.14.18-14.21.3.17.el8 x86_64 0:18.20.8-4.el8 0:18.20.8-4.el8 x86_64 0:10.8.2-18.20.8.4.el8 x86_64 0:14.21.3-18.el8 0:14.21.3-18.el8 x86_64 1:6.14.18-14.21.3.18.el8 x86_64 0:12.22.12-15.el8 0:12.22.12-15.el8 x86_64 1:6.14.16-12.22.12.15.el8 x86_64 0:12.22.12-16.el8 0:12.22.12-16.el8 x86_64 1:6.14.16-12.22.12.16.el8 x86_64 0:14.21.3-19.el8 0:14.21.3-19.el8 x86_64 1:6.14.18-14.21.3.19.el8 x86_64 0:16.20.2-12.el8 0:16.20.2-12.el8 x86_64 0:8.19.4-16.20.2.12.el8 x86_64 0:18.20.8-5.el8 0:18.20.8-5.el8 x86_64 0:10.8.2-18.20.8.5.el8 x86_64 0:16.20.2-13.el8 0:16.20.2-13.el8 x86_64 0:8.19.4-16.20.2.13.el8 x86_64 0:18.20.8-6.el8 0:18.20.8-6.el8 x86_64 0:10.8.2-18.20.8.6.el8 x86_64 0:12.22.12-17.el8 0:12.22.12-17.el8 x86_64 1:6.14.16-12.22.12.17.el8 x86_64 0:16.20.2-17.el8 0:16.20.2-17.el8 x86_64 0:8.19.4-16.20.2.17.el8 x86_64 0:18.20.8-9.el8 0:18.20.8-9.el8 x86_64 0:10.8.2-18.20.8.9.el8 x86_64 0:16.20.2-18.el8 0:16.20.2-18.el8 x86_64 0:8.19.4-16.20.2.18.el8 x86_64 0:14.21.3-21.el8 0:14.21.3-21.el8 x86_64 1:6.14.18-14.21.3.21.el8 x86_64 0:20.20.2-2.el8 0:20.20.2-2.el8 x86_64 0:10.8.2-20.20.2.2.el8 x86_64 0:12.22.12-19.el8 0:12.22.12-19.el8 x86_64 1:6.14.16-12.22.12.19.el8 x86_64 0:16.20.2-20.el8 0:16.20.2-20.el8 x86_64 0:8.19.4-16.20.2.20.el8 x86_64 0:14.21.3-22.el8 0:14.21.3-22.el8 x86_64 1:6.14.18-14.21.3.22.el8 x86_64 0:16.20.2-21.el8 0:16.20.2-21.el8 x86_64 0:8.19.4-16.20.2.21.el8 x86_64 0:18.20.8-13.el8 0:18.20.8-13.el8 x86_64 0:10.8.2-18.20.8.13.el8 x86_64 0:12.22.12-20.el8 0:12.22.12-20.el8 x86_64 1:6.14.16-12.22.12.20.el8 x86_64 0:14.21.3-23.el8 0:14.21.3-23.el8 x86_64 1:6.14.18-14.21.3.23.el8 x86_64 0:16.20.2-22.el8 0:16.20.2-22.el8 x86_64 0:8.19.4-16.20.2.22.el8 x86_64 0:12.22.12-21.el8 0:12.22.12-21.el8 x86_64 1:6.14.16-12.22.12.21.el8 x86_64 0:12.22.12-22.el8 0:12.22.12-22.el8 x86_64 1:6.14.16-12.22.12.22.el8 x86_64 0:14.21.3-24.el8 0:14.21.3-24.el8 x86_64 1:6.14.18-14.21.3.24.el8 x86_64 0:16.20.2-23.el8 0:16.20.2-23.el8 x86_64 0:8.19.4-16.20.2.23.el8 x86_64 0:18.20.8-14.el8 0:18.20.8-14.el8 x86_64 0:10.8.2-18.20.8.14.el8 x86_64 0:20.20.2-3.el8 0:20.20.2-3.el8 x86_64 0:10.8.2-20.20.2.3.el8 x86_64 0:18.20.8-17.el8 0:18.20.8-17.el8 x86_64 0:10.8.2-18.20.8.17.el8 x86_64 0:20.20.2-6.el8 0:20.20.2-6.el8 x86_64 0:10.8.2-20.20.2.6.el8 x86_64 0:14.21.3-25.el8 0:14.21.3-25.el8 x86_64 1:6.14.18-14.21.3.25.el8 x86_64 0:14.21.3-26.el8 0:14.21.3-26.el8 x86_64 1:6.14.18-14.21.3.26.el8 x86_64 0:12.22.12-24.el8 0:12.22.12-24.el8 x86_64 1:6.14.16-12.22.12.24.el8 x86_64 0:18.20.8-12.el8 0:18.20.8-12.el8 x86_64 0:10.8.2-18.20.8.12.el8 x86_64 0:16.20.2-24.el8 0:16.20.2-24.el8 x86_64 0:8.19.4-16.20.2.24.el8 x86_64 0:12.22.12-26.el8 0:12.22.12-26.el8 x86_64 1:6.14.16-12.22.12.26.el8 x86_64 0:14.21.3-28.el8 0:14.21.3-28.el8 x86_64 1:6.14.18-14.21.3.28.el8