UnratedFix available
Node.js 26.5.1 (Current)
Node.js 26.5.1 is a security release addressing multiple vulnerabilities. The announcement lists issues rated High, Medium, and Low.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
This is a security release.
Node.js
Node.js 26.5.1 (Current)
- Affected versions
- Not stated in this extraction
- Fixed versions
- 26.5.1
Version 26.5.1 (Current)
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2026-56848
(CVE-2026-56848) http2: defer rst stream while in scope (Matteo Collina) – High
CVE-2026-58043(CVE-2026-58043) permission: avoid granting radix split nodes (RafaelGSS) – High
CVE-2026-56850(CVE-2026-56850) https: distinguish PFX object-array agent keys (RafaelGSS) – Medium
CVE-2026-58040(CVE-2026-58040) https: bind identity checks to session reuse (Matteo Collina) – Medium
CVE-2026-58041(CVE-2026-58041) sqlite: invalidate tag store iterators on statement reset (Matteo Collina) – Medium
CVE-2026-58042(CVE-2026-58042) dns: handle large resolveAny address replies (RafaelGSS) – Medium
CVE-2026-58045(CVE-2026-58045) zlib: throw on out-of-bounds write buffers (RafaelGSS) – Medium
CVE-2026-56847(CVE-2026-56847) permission: enforce fs write permission for trace events (RafaelGSS) – Low
CVE-2026-58039(CVE-2026-58039) permission: check final report output path (RafaelGSS) – Low
CVE-2026-58044(CVE-2026-58044) http: reject requests exceeding max header count (Matteo Collina) – Low
Publisher severity
No explicit severity was extracted.
- Event
- #19328 · Revision 1
- Added to Heist Feed
- Publisher date