CVE-2026-56848Patch

CVE-2026-56846, CVE-2026-56848 & CVE-2026-58043 and other: 3 high-severity and 8 medium or low vulnerabilities in Node.js ‍🔥 Recently disclosed vulnerabilities in Node.js touch HTTP/2, the Permission Model, and several core modules. 👉 https://nt.ls/AAg1f

Node.js patched 11 vulnerabilities in its July 2026 release. The high-severity bugs include a HTTP/2 use-after-free (CVE-2026-56848). Update now. #NodeJS #CVE202656848 #HTTP2 #UseAfterFree #Vulnerability #InfoSec http://securityonline.info/nodejs-july-2026-security-release/

CVE-2026-56848: Node.js HTTP/2 Heap Use-After-Free - What It Means for Your Business and How to Respond https://hubs.li/Q04wnnzs0

Node.js の 11件の脆弱性が FIX：不正なファイル・システム・アクセスやメモリ破壊の恐れ https://iototsecnews.jp/2026/07/30/node-js-fixes-11-security-flaws-that-can-crash-servers-and-break-filesystem-restrictions/ Node.js において、HTTP/2 処理や実行権限管理の不備に起因する複数の脆弱性 CVE-2026-56846／CVE-2026-56848／CVE-2026-58043 などが公表されました。この問題は、通信処理時のメモリ制限回避や、データ解放後の不正アクセス、アクセス許可領域の誤判定などに起因しています。悪用された場合には、サーバ・メモリの枯渇によるサービス停止や、意図しないファイル読み書き、システム・クラッシュが引き起こされる恐れがあります。対応策として、修正パッチが適用された最新バージョンへの速やかな移行や、本番環境での動作検証が有効です。システムを安全に利用するためにも、依存ライブラリを含めた環境のアップデートを実施することが推奨されます。 #CVE202656846 #CVE202656847 #CVE202656848 #CVE202656850 #CVE202658039 #CVE202658040 #CVE202658041 #CVE202658042 #CVE202658043 #CVE202658044 #CVE202658045 #Node.js #Vulnerability

Recent Key Vulnerabilities Affecting Node.js 20 Prior to and surrounding its EOL timeline, several critical security issues were identified that impact the Node.js 20.x runtime line:😁 • HTTP/2 RST_STREAM Heap Use-After-Free (CVE-2026-56848): A High severity flaw where a remote, unauthenticated attacker can trigger a process crash. The HTTP/2 server can force a stream write that re-enters session memory allocation while it is still processing received frames, resulting in an availability denial-of-service (DoS). • Permission Model Radix-Tree Over-Grant (CVE-2026-58043): A High severity issue where a flaw in prefix boundary handling allows an attacker with partial filesystem access to read or write to paths completely outside the intended restricted allowlist. • HTTP/2 Resource Exhaustion (CVE-2026-56846): A High severity memory flaw where retained header blocks escape the maxSessionMemory limit, allowing a remote client to consume all process memory and force a crash. • Bypass File System Permissions via Symlinks (CVE-2025-55130): A High severity flaw in the Permissions model where path restrictions (--allow-fs-read and --allow-fs-write) can be escaped using relative symbolic links, enabling unauthorized system file access. • TLS Callback Exceptions DoS (CVE-2026-21637): A Medium severity bug where synchronous exceptions thrown inside pskCallback or ALPNCallback bypass standard TLS error paths, causing file descriptor leaks or sudden process termination.

Node.js 2026年7月のパッチで11件の脆弱性を修正(CVE-2026-56846,CVE-2026-56848)等 https://rocket-boys.co.jp/security-measures-lab/nodejs-july-2026-security-patch-11-vulnerabilities-fixed/ #セキュリティ対策Lab #security #securitynews #脆弱性

Node.js has patched 11 security flaws across its 22.x, 24.x, and 26.x release lines, with patched versions 22.23.2, 24.18.1, and 26.5.1 released July 29. Top high-severity issues include an HTTP/2 memory exhaustion bug (CVE-2026-56846), a use-after-free flaw in HTTP/2 processing (CVE-2026-56848), and a Permission Model bypass (CVE-2026-58043) letting attackers escape restricted filesystem paths. 🔵 Also fixed: TLS identity leakage across cert configs, incomplete hostname verification, and an HTTP request smuggling risk via header truncation 🔵 Upgrade immediately — EOL versions remain unpatched and exposed