{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"High" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"nodejs security update", "category":"general", "title":"Synopsis" }, { "text":"An update for nodejs is now available for openEuler-22.03-LTS-SP4", "category":"general", "title":"Summary" }, { "text":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\nA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on('secureConnection', socket => {\n socket.on('error', err => {\n console.log(err)\n })\n})\n```(CVE-2025-59465)\n\nA flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.(CVE-2026-21637)\n\nA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\n\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.(CVE-2026-21714)", "category":"general", "title":"Description" }, { "text":"An update for nodejs is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP3/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP2/openEuler-24.03-LTS-SP3.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"High", "category":"general", "title":"Severity" }, { "text":"nodejs", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-2821", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2821" }, { "summary":"CVE-2025-59465", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-59465&packageName=nodejs" }, { "summary":"CVE-2026-21637", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-21637&packageName=nodejs" }, { "summary":"CVE-2026-21714", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-21714&packageName=nodejs" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59465" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21637" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21714" }, { "summary":"openEuler-SA-2026-2821 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-2821.json" } ], "title":"An update for nodejs is now available for openEuler-22.03-LTS-SP4", "tracking":{ "initial_release_date":"2026-07-06T16:52:40+08:00", "revision_history":[ { "date":"2026-07-06T16:52:40+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-07-06T16:52:40+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-07-06T16:52:40+08:00", "id":"openEuler-SA-2026-2821", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"openEuler-22.03-LTS-SP4", "name":"openEuler-22.03-LTS-SP4" }, "name":"openEuler-22.03-LTS-SP4", "category":"product_version" } ], "category":"product_name" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-12.22.11-13.oe2203sp4.aarch64.rpm", "name":"nodejs-12.22.11-13.oe2203sp4.aarch64.rpm" }, "name":"nodejs-12.22.11-13.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64.rpm", "name":"nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64.rpm" }, "name":"nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64.rpm", "name":"nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64.rpm" }, "name":"nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-devel-12.22.11-13.oe2203sp4.aarch64.rpm", "name":"nodejs-devel-12.22.11-13.oe2203sp4.aarch64.rpm" }, "name":"nodejs-devel-12.22.11-13.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64.rpm", "name":"nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64.rpm" }, "name":"nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-libs-12.22.11-13.oe2203sp4.aarch64.rpm", "name":"nodejs-libs-12.22.11-13.oe2203sp4.aarch64.rpm" }, "name":"nodejs-libs-12.22.11-13.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64.rpm", "name":"npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64.rpm" }, "name":"npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64.rpm", "name":"v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64.rpm" }, "name":"v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-12.22.11-13.oe2203sp4.src.rpm", "name":"nodejs-12.22.11-13.oe2203sp4.src.rpm" }, "name":"nodejs-12.22.11-13.oe2203sp4.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-12.22.11-13.oe2203sp4.x86_64.rpm", "name":"nodejs-12.22.11-13.oe2203sp4.x86_64.rpm" }, "name":"nodejs-12.22.11-13.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64.rpm", "name":"nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64.rpm" }, "name":"nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64.rpm", "name":"nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64.rpm" }, "name":"nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-devel-12.22.11-13.oe2203sp4.x86_64.rpm", "name":"nodejs-devel-12.22.11-13.oe2203sp4.x86_64.rpm" }, "name":"nodejs-devel-12.22.11-13.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64.rpm", "name":"nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64.rpm" }, "name":"nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-libs-12.22.11-13.oe2203sp4.x86_64.rpm", "name":"nodejs-libs-12.22.11-13.oe2203sp4.x86_64.rpm" }, "name":"nodejs-libs-12.22.11-13.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64.rpm", "name":"npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64.rpm" }, "name":"npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64.rpm", "name":"v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64.rpm" }, "name":"v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"noarch", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4" }, "product_id":"nodejs-docs-12.22.11-13.oe2203sp4.noarch.rpm", "name":"nodejs-docs-12.22.11-13.oe2203sp4.noarch.rpm" }, "name":"nodejs-docs-12.22.11-13.oe2203sp4.noarch.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-12.22.11-13.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.aarch64", "name":"nodejs-12.22.11-13.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64", "name":"nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64", "name":"nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-devel-12.22.11-13.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.aarch64", "name":"nodejs-devel-12.22.11-13.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64", "name":"nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-libs-12.22.11-13.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.aarch64", "name":"nodejs-libs-12.22.11-13.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64", "name":"npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64", "name":"v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-12.22.11-13.oe2203sp4.src.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.src", "name":"nodejs-12.22.11-13.oe2203sp4.src as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-12.22.11-13.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.x86_64", "name":"nodejs-12.22.11-13.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64", "name":"nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64", "name":"nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-devel-12.22.11-13.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.x86_64", "name":"nodejs-devel-12.22.11-13.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64", "name":"nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-libs-12.22.11-13.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.x86_64", "name":"nodejs-libs-12.22.11-13.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64", "name":"npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64", "name":"v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64 as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-22.03-LTS-SP4", "product_reference":"nodejs-docs-12.22.11-13.oe2203sp4.noarch.rpm", "full_product_name":{ "product_id":"openEuler-22.03-LTS-SP4:nodejs-docs-12.22.11-13.oe2203sp4.noarch", "name":"nodejs-docs-12.22.11-13.oe2203sp4.noarch as a component of openEuler-22.03-LTS-SP4" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2025-59465", "notes":[ { "text":"A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on('secureConnection', socket => {\n socket.on('error', err => {\n console.log(err)\n })\n})\n```", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.src", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-docs-12.22.11-13.oe2203sp4.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.src", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-docs-12.22.11-13.oe2203sp4.noarch" ], "details":"nodejs security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2821" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.src", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-docs-12.22.11-13.oe2203sp4.noarch" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2025-59465" }, { "cve":"CVE-2026-21637", "notes":[ { "text":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.src", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-docs-12.22.11-13.oe2203sp4.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.src", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-docs-12.22.11-13.oe2203sp4.noarch" ], "details":"nodejs security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2821" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.src", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-docs-12.22.11-13.oe2203sp4.noarch" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-21637" }, { "cve":"CVE-2026-21714", "notes":[ { "text":"A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\n\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.src", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-docs-12.22.11-13.oe2203sp4.noarch" ] }, "remediations":[ { "product_ids":[ "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.src", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-docs-12.22.11-13.oe2203sp4.noarch" ], "details":"nodejs security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2821" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.3, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version":"3.1" }, "products":[ "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.aarch64", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.src", "openEuler-22.03-LTS-SP4:nodejs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debuginfo-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-debugsource-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-devel-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-full-i18n-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-libs-12.22.11-13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:npm-6.14.16-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:v8-devel-7.8.279.23-1.12.22.11.13.oe2203sp4.x86_64", "openEuler-22.03-LTS-SP4:nodejs-docs-12.22.11-13.oe2203sp4.noarch" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-21714" } ] }