{
  "cveId": "CVE-2026-22036",
  "url": "https://patchblox.com/security/cve/CVE-2026-22036",
  "summary": "CVE-2026-22036 is fixed in 13 products on 1 platform, first by DEBIAN-CVE-2026-22036, released January 14, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "nodejs20: This update for nodejs20 fixes the following issues:\n\n- CVE-2025-22150: undici: predictable random values used when d...",
  "description": "This update for nodejs20 fixes the following issues:\n\n- CVE-2025-22150: undici: predictable random values used when defining the boundary for a \u0060multipart\u0060/\u0060form-data\u0060\n  request (bsc#1236258).\n- CVE-2026-6733: undici: response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery\n  (bsc#1268479).\n- CVE-2026-9496: pacote: excessive CPU consumption in \u0060addGitSha\u0060 when processing a specially crafted \u0060spec.rawSpec\u0060\n  value can lead to DoS (bsc#1266318).\n- CVE-2026-9679: undici: HTTP header injection via \u0060Set-Cookie\u0060 percent-decoding (bsc#1268477).\n- CVE-2026-11525: undici: weakening of cookie \u0060SameSite\u0060 policy due to incorrect parsing of \u0060Set-Cookie\u0060 header\n  (bsc#1268481).\n- CVE-2026-12151: undici: denial of service due to unbounded memory growth via WebSocket frames (bsc#1268482).\n- CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).\n- CVE-2026-16729: undici: \u0060setCookie\u0060 function does not fully sanitize cookie attributes (bsc#1273591).\n- CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via \u0060Content-Encoding\u0060 may lead to resource\n  exhaustion (bsc#1256848).\n- CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).\n- CVE-2026-40170: ngtcp2: qlog \u0060parameters_set\u0060 stack buffer overflow (bsc#1262274).\n- CVE-2026-42338: ip-address: cross-site scripting via improper HTML escaping of untrusted input (bsc#1268097).\n- CVE-2026-48615: proxy credentials leaked in \u0060ERR_PROXY_TUNNEL\u0060 error message (bsc#1268598).\n- CVE-2026-48617: permission model enforcement bypass via \u0060process.report.writeReport()\u0060 path misvalidation\n  (bsc#1268554).\n- CVE-2026-48618: unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to\n  resolver and verifier hostname normalization mismatch (bsc#1268593).\n- CVE-2026-48619: unbounded memory growth in \u0060node:http2\u0060 clients via attacker-controlled \u0060ORIGIN\u0060 frames (bsc#1268618).\n- CVE-2026-48928: uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname\n  matching (bsc#1268605).\n- CVE-2026-48930: \u0060embedded-nul\u0060 hostnames can lead to silent authority rebinding due to \u0060c-string\u0060 truncation in\n  resolver bindings (bsc#1268606).\n- CVE-2026-48931: HTTP response queue poisoning via TOCTOU race condition in \u0060http.Agent\u0060 (bsc#1268611).\n- CVE-2026-48933: WebCrypto AES integer overflow leads to remote process abort (bsc#1268592).\n- CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to\n  unauthorized connections (bsc#1268608).\n- CVE-2026-48935: permission model bypass via \u0060FileHandle.utimes()\u0060 in the \u0060promises\u0060 API (bsc#1268609).\n- CVE-2026-48937: servers keep accepting data even after sending a \u0060GOAWAY\u0060 frame (bsc#1268555).\n- CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust-\n  boundary checks (bsc#1272882).\n- CVE-2026-56846: HTTP/2 retained headers can bypass \u0060maxSessionMemory\u0060 limits (bsc#1272941).\n- CVE-2026-56847: permission model allows trace events to write outside the allowlist (bsc#1272949).\n- CVE-2026-56848: HTTP/2 re-entrant send can cause heap use-after-free (bsc#1272942).\n- CVE-2026-56850: HTTPS agent can reuse mTLS identities across PFX certificates (bsc#1272944).\n- CVE-2026-58039: permission model allows process reports to write outside the allowlist (bsc#1272950).\n- CVE-2026-58040: HTTPS agent session reuse can skip hostname verification (bsc#1272945).\n- CVE-2026-58042: \u0060dns.resolveAny()\u0060 can abort on DNS responses with many \u0060A\u0060 records (bsc#1272947).\n- CVE-2026-58043: permission model path matching can over-grant filesystem access (bsc#1272943).\n- CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).\n- CVE-2026-58045: \u0060node:zlib\u0060 sync APIs can crash on spoofed \u0060TypedArray\u0060 length (bsc#1272948).\n- CVE-2026-69192: ip-address: \u0060Address4\u0060 decodes leading-zero octets as decimal while resolvers decode them as octal,\n  which allows for SSRF and trust-boundary bypass (bsc#1277587).",
  "published": "2026-01-14T19:16:47Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00457,
  "epssPercentile": 0.39867,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-undici",
      "release": "Debian 14",
      "fixedVersion": "7.18.2\u002Bdfsg\u002B~cs3.2.0-1",
      "fix": "DEBIAN-CVE-2026-22036",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-22036",
      "released": "2026-01-14T19:16:47Z"
    },
    {
      "platform": "linux",
      "product": "nodejs20",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "20.20.0-150600.3.15.1",
      "fix": "SUSE-SU-2026:0435-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0435-1",
      "released": "2026-02-11T09:25:11Z"
    },
    {
      "platform": "linux",
      "product": "nodejs20",
      "release": "sles 15.6",
      "fixedVersion": "20.20.2-150600.3.21.1",
      "fix": "SUSE-SU-2026:3929-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3929-1",
      "released": "2026-09-03T07:18:06Z"
    },
    {
      "platform": "linux",
      "product": "nodejs20",
      "release": "sles 15.6",
      "fixedVersion": "20.20.0-150600.3.15.1",
      "fix": "SUSE-SU-2026:0435-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0435-1",
      "released": "2026-02-11T09:25:11Z"
    },
    {
      "platform": "linux",
      "product": "nodejs22",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "22.22.0-150600.13.12.1",
      "fix": "SUSE-SU-2026:0295-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0295-1",
      "released": "2026-01-26T13:19:01Z"
    },
    {
      "platform": "linux",
      "product": "nodejs22",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "22.22.0-160000.1.1",
      "fix": "OPENSUSE-SU-2026:20236-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20236-1",
      "released": "2026-02-15T09:26:17Z"
    },
    {
      "platform": "linux",
      "product": "nodejs22",
      "release": "sles 15.6",
      "fixedVersion": "22.22.0-150600.13.12.1",
      "fix": "SUSE-SU-2026:0295-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0295-1",
      "released": "2026-01-26T13:19:01Z"
    },
    {
      "platform": "linux",
      "product": "nodejs22",
      "release": "sles 15.7",
      "fixedVersion": "22.22.0-150700.3.6.1",
      "fix": "SUSE-SU-2026:0301-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0301-1",
      "released": "2026-01-27T08:20:46Z"
    },
    {
      "platform": "linux",
      "product": "nodejs22",
      "release": "sles 16.0",
      "fixedVersion": "22.22.0-160000.1.1",
      "fix": "SUSE-SU-2026:20436-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20436-1",
      "released": "2026-02-15T08:45:21Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24",
      "release": "amzn 2023",
      "fixedVersion": "1:24.13.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1404",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1404",
      "released": "2026-02-05T22:03:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:24.13.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1404",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1404",
      "released": "2026-02-05T22:03:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1:24.13.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1404",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1404",
      "released": "2026-02-05T22:03:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:24.13.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1404",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1404",
      "released": "2026-02-05T22:03:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-docs",
      "release": "amzn 2023",
      "fixedVersion": "1:24.13.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1404",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1404",
      "released": "2026-02-05T22:03:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-full-i18n",
      "release": "amzn 2023",
      "fixedVersion": "1:24.13.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1404",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1404",
      "released": "2026-02-05T22:03:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-libs",
      "release": "amzn 2023",
      "fixedVersion": "1:24.13.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1404",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1404",
      "released": "2026-02-05T22:03:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:24.13.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1404",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1404",
      "released": "2026-02-05T22:03:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-npm",
      "release": "amzn 2023",
      "fixedVersion": "1:11.6.2-1.24.13.0.1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1404",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1404",
      "released": "2026-02-05T22:03:00Z"
    },
    {
      "platform": "linux",
      "product": "v8-13.6-devel",
      "release": "amzn 2023",
      "fixedVersion": "3:13.6.233.17-1.24.13.0.1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1404",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1404",
      "released": "2026-02-05T22:03:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}