K000162755: Node.js CVE-2026-48937

Security Advisory Description A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24. CVE-2026-48937 Impact There is no impact; F5 products are not affected b...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP client when forwarding proxies rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. An attacker can manipulate HTTP request...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits. Remediation A fix was...

ALPINE-CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-58042

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

ALPINE-CVE-2026-58042

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

ALPINE-CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-58045

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

CVE-2026-58042

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

CVE-2026-56846

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

CVE-2026-58042

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-58045

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

CVE-2026-58042

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-58045

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...

EUVD-2026-52553

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...