dns.resolve truncates names containing NUL char (CVE-2026-105482) - (high)
TLS certificate hostname bypass when the IP is written fullwidth digits (CVE-2026-105483) - (high)
TLS certificate hostname bypass when the host loosely resolves to an IP address (CVE-2026-106069) - (high)
Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high)
Keep-alive socket process a response that was written before the request was sent (CVE-2026-105481) - (medium)
Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (CVE-2026-106072) - (medium)
crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (CVE-2026-106074) - (medium)
Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation (CVE-2026-106070) - (low)
Permission Model filesystem over-grant via wildcard radix lookup (CVE-2026-106071) - (low)
Permission Model bypass with fs.realpathSync (CVE-2026-106073) - (low)