MGASA-2026-0071

Advisory lineage Upstream: 7 Downstream: 0
Published: 28 Mar 2026, 07:26
Last modified:16 Apr 2026, 04:18

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

28 Mar 2026, 07:26
Published
Vulnerability first disclosed
16 Apr 2026, 04:18
Last Modified
Vulnerability information updated

Description

Updated nodejs packages fix security vulnerabilities Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS. (CVE-2026-21637) Denial of Service via __proto__ header name in req.headersDistinct (Uncaught TypeError crashes Node.js process). (CVE-2026-21710) Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery. (CVE-2026-21713) Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion. (CVE-2026-21714) Permission Model Bypass in realpathSync.native Allows File Existence Disclosure. (CVE-2026-21715) CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown. (CVE-2026-21716) HashDoS in V8. (CVE-2026-21717)

Affected Systems

  • mageia•nodejs

    < 22.22.2-1.mga9

References (3)