PR-URL: #63664

PR-URL: #63820
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

PR-URL: #63820
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Richard Lau <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Filip Skokan <[email protected]>

PR-URL: #63779
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Ulises Gascón <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>
Reviewed-By: Matthew Aitken <[email protected]>
Reviewed-By: Rafael Gonzaga <[email protected]>

PR-URL: #63903
Reviewed-By: Matthew Aitken <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Trivikram Kamat <[email protected]>

Refs: https://hackerone.com/reports/3720313
Signed-off-by: Matteo Collina <[email protected]>
PR-URL: nodejs-private/node-private#867
Reviewed-By: Joyee Cheung <[email protected]>
CVE-ID: CVE-2026-48615

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: nodejs-private/node-private#870
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48617
Refs: https://hackerone.com/reports/3625987

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: nodejs-private/node-private#869
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48618
Refs: https://hackerone.com/reports/3688064

PR-URL: nodejs-private/node-private#890
Reviewed-By: Tobias Nießen <[email protected]>

A malicious HTTP/2 server can send repeated ORIGIN frames with unique
origins, causing unbounded growth of the client-side originSet for the
lifetime of the session. Cap the set at 128 entries; once full, new
origins from ORIGIN frames are silently dropped.

Refs: https://hackerone.com/reports/3676863
PR-URL: nodejs-private/node-private#855
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48619

The regex constructed by server.addContext() lacked the case-insensitive
flag, causing uppercase or mixed-case SNI hostnames from ClientHello to
miss their intended context and fall back to the default context. This
violates RFC 6066 Section 3, which states that DNS hostnames are
case-insensitive. In mTLS configurations with per-tenant contexts, this
allowed bypassing client certificate authorization by simply
uppercasing the SNI hostname.

Add the 'i' flag to the RegExp in addContext() so that SNI matching
is case-insensitive.

PR-URL: nodejs-private/node-private#857
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48928
Refs: https://hackerone.com/reports/3656869

Refs: https://hackerone.com/reports/3656716
PR-URL: nodejs-private/node-private#868
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48930

PR-URL: nodejs-private/node-private#854
Reviewed-By: Robert Nagy <[email protected]>
CVE-ID: CVE-2020-8172
Refs: https://hackerone.com/reports/3649802

PR-URL: nodejs-private/node-private#854
Reviewed-By: Robert Nagy <[email protected]>
CVE-ID: CVE-2026-48934
Refs: https://hackerone.com/reports/3649802

PR-URL: nodejs-private/node-private#873
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48935
Refs: https://hackerone.com/reports/3625987

Signed-off-by: RafaelGSS <[email protected]>
PR-URL: nodejs-private/node-private#885
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48936
Refs: https://hackerone.com/reports/3618831

Attach a data guard listener on idle keepAlive sockets in the
freeSockets pool. If unsolicited data arrives while the socket
is idle, destroy it immediately to prevent response queue poisoning.

Refs: https://hackerone.com/reports/3582376
PR-URL: nodejs-private/node-private#846
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48931

Reject WebCrypto cipher operations whose computed output length would
exceed INT_MAX before passing the length to OpenSSL.

This avoids signed overflow in the AES and ChaCha20-Poly1305 one-shot
cipher paths and turns oversized inputs into a clean operation failure.

Refs: https://hackerone.com/reports/3760016
Signed-off-by: Filip Skokan <[email protected]>
PR-URL: nodejs-private/node-private#878
Reviewed-By: Antoine du Hamel <[email protected]>
CVE-ID: CVE-2026-48933

This is a security release.

Notable changes:

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low
* (CVE-2026-48936) permission: guard pipe open and chmod with net scope (RafaelGSS) – Low

PR-URL: nodejs-private/node-private#897