MGASA-2026-0257

Advisory lineage Upstream: 11 Downstream: 0
Published: 18 Jul 2026, 05:48
Last modified:18 Jul 2026, 06:00

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

18 Jul 2026, 05:48
Published
Vulnerability first disclosed
18 Jul 2026, 06:00
Last Modified
Vulnerability information updated

Description

Updated nodejs packages fix security vulnerabilities lib,test: redact proxy credentials in tunnel errors. (CVE-2026-48615) permission: handle process.chdir on writereport. (CVE-2026-48617) tls: normalize hostname for server identity checks. (CVE-2026-48618) http2: cap originSet size to prevent unbounded memory growth. (CVE-2026-48619) tls: fix case-sensitive SNI context matching. (CVE-2026-48928) dns,net: reject hostnames with embedded NUL bytes. (CVE-2026-48930) http: fix response queue poisoning in http.Agent. (CVE-2026-48931) crypto: guard WebCrypto cipher output length. (CVE-2026-48933) tls: bind reusable sessions to authenticated host. (CVE-2026-48934) permission: disable FileHandle utimes with permission model. (CVE-2026-48935) deps: fix integration issues with the latest nghttp2. (CVE-2026-48937)

Affected Systems

  • mageia•nodejs

    < 22.23.1-2.mga10

  • mageia•nodejs

    < 22.23.1-2.mga9

References (4)