MGASA-2026-0359
Advisory lineage Upstream: 10 Downstream: 0
Published: 01 Sept 2026, 03:06
Last modified:01 Sept 2026, 03:26
Vulnerability Summary
Overall Risk (default)
minimal
0/100 CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
01 Sept 2026, 03:06
Published
Vulnerability first disclosed
01 Sept 2026, 03:26
Last Modified
Vulnerability information updated
Description
Updated nodejs packages fix security vulnerabilities http2: retain header memory in session accounting. (CVE-2026-56846) http2: defer rst stream while in scope. (CVE-2026-56848) permission: avoid granting radix split nodes. (CVE-2026-58043) https: distinguish PFX object-array agent keys. (CVE-2026-56850) https: bind identity checks to session reuse. (CVE-2026-58040) dns: handle large resolveAny address replies. (CVE-2026-58042) zlib: throw on out-of-bounds write buffers. (CVE-2026-58045) permission: enforce fs write permission for trace events. (CVE-2026-56847) permission: check final report output path. (CVE-2026-58039) http: reject requests exceeding max header count. (CVE-2026-58044)
Affected Systems
- mageia•nodejs
< 22.23.2-1.mga10
- mageia•nodejs
< 22.23.2-1.mga9