{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "NodeJS Node: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/nodejs--node/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/nodejs--node/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106069/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106069/",
   "title": "CVE-2026-106069 disclosed",
   "content_text": "A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.\n\n`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106069/fixed/alpine-v3.21",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106069/",
   "title": "CVE-2026-106069 fixed in Alpine:v3.21",
   "content_text": "Fixed versions: nodejs 22.23.4-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106069/fixed/alpine-v3.22",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106069/",
   "title": "CVE-2026-106069 fixed in Alpine:v3.22",
   "content_text": "Fixed versions: nodejs 22.23.4-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106069/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106069/",
   "title": "CVE-2026-106069 fixed in Alpine:v3.23",
   "content_text": "Fixed versions: nodejs 24.22.1-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106069/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106069/",
   "title": "CVE-2026-106069 fixed in Alpine:v3.24",
   "content_text": "Fixed versions: nodejs 24.22.1-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106069/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106069/",
   "title": "CVE-2026-106069 fixed in Chainguard",
   "content_text": "Fixed versions: nodejs-22 22.23.4-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106069/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106069/",
   "title": "CVE-2026-106069 fixed in openSUSE:Tumbleweed",
   "content_text": "Fixed versions: nodejs24 24.22.1-1.1.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106069/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106069/",
   "title": "CVE-2026-106069 fixed in Wolfi",
   "content_text": "Fixed versions: nodejs-22 22.23.4-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105482/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105482/",
   "title": "CVE-2026-105482 disclosed",
   "content_text": "A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.\r\n\r\nBecause the name is passed to c-ares as a C string, resolving attacker.example\\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated.\r\n\r\nThis vulnerability affects Node.js 26.x, 24.x, and 22.x.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105482/fixed/alpine-v3.21",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105482/",
   "title": "CVE-2026-105482 fixed in Alpine:v3.21",
   "content_text": "Fixed versions: nodejs 22.23.4-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105482/fixed/alpine-v3.22",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105482/",
   "title": "CVE-2026-105482 fixed in Alpine:v3.22",
   "content_text": "Fixed versions: nodejs 22.23.4-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105482/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105482/",
   "title": "CVE-2026-105482 fixed in Alpine:v3.23",
   "content_text": "Fixed versions: nodejs 24.22.1-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105482/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105482/",
   "title": "CVE-2026-105482 fixed in Alpine:v3.24",
   "content_text": "Fixed versions: nodejs 24.22.1-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105482/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105482/",
   "title": "CVE-2026-105482 fixed in Chainguard",
   "content_text": "Fixed versions: nodejs-22 22.23.4-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105482/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105482/",
   "title": "CVE-2026-105482 fixed in openSUSE:Tumbleweed",
   "content_text": "Fixed versions: nodejs24 24.22.1-1.1.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105482/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105482/",
   "title": "CVE-2026-105482 fixed in Wolfi",
   "content_text": "Fixed versions: nodejs-22 22.23.4-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105483/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105483/",
   "title": "CVE-2026-105483 disclosed",
   "content_text": "A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).\n\n`tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618.\n\nThis vulnerability affects Node.js **26.x** and **24.x**.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105483/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105483/",
   "title": "CVE-2026-105483 fixed in Alpine:v3.23",
   "content_text": "Fixed versions: nodejs 24.22.1-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105483/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105483/",
   "title": "CVE-2026-105483 fixed in Alpine:v3.24",
   "content_text": "Fixed versions: nodejs 24.22.1-r0.",
   "date_published": "2026-10-23T16:15:05Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-105483/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-105483/",
   "title": "CVE-2026-105483 fixed in openSUSE:Tumbleweed",
   "content_text": "Fixed versions: nodejs24 24.22.1-1.1.",
   "date_published": "2026-10-23T16:15:05Z"
  }
 ]
}