{
  "cveId": "CVE-2026-48816",
  "url": "https://patchblox.com/security/cve/CVE-2026-48816",
  "summary": "CVE-2026-48816 is fixed in 10 products on 1 platform, first by ALAS2023-2026-1920, released July 6, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "nodejs24: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2026-9697:\n\tundici\u0027s...",
  "description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2026-9697:\n\tundici\u0027s ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node\u0027s default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.\n\nApplications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.\n\nAffected applications are those that use undici\u0027s ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.\n\nCVE-2026-9679:\n\tundici\u0027s cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 SS5.4 does not specify any decoding and browsers do not decode either.\n\nApplications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application\u0027s downstream response, enabling session fixation, open redirect, or cache poisoning.\n\nAffected applications are those that use undici\u0027s cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.\n\nThis was introduced in undici 7.0.0\n\nCVE-2026-9678:\n\tUndici\u0027s cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=\u0022 authorization\u0022 or no-cache=\u0022\\tauthorization\u0022. The parser preserves the surrounding whitespace, so later comparisons against the literal authorization field name fail and the response is stored.\n\nIn shared-cache mode, this allows a response containing one user\u0027s authenticated data to be served from cache to a subsequent caller, including an unauthenticated caller, when both requests resolve to the same cache key.\n\nAffected applications are those that explicitly enable the cache interceptor (interceptors.cache()) in shared mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified private or no-cache directives.\n\nCVE-2026-6734:\n\tWhen using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool\u0027s origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.\n\nThis causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.\n\nImpacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.\n\nThis was introduced in undici 7.23.0 via #4385 and affects all versions through 8.1.0.\n\nCVE-2026-6733:\n\tUndici\u0027s HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.\n\nThis requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.\n\nCVE-2026-48937:\n\tA flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a \u0060GOAWAY\u0060 frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.\n\nCVE-2026-48935:\n\tA flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. --allow-fs-read.\n\nThis vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.\n\nCVE-2026-48934:\n\tA flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.\n\nThis vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.\n\nCVE-2026-48933:\n\tA flaw in Node.js WebCrypto implementation can crash the process if the input of subtle.encrypt() is a multiple of 2GiB.\n\nThis vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.\n\nCVE-2026-48931:\n\tA flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.\n\nThis vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.\n\nCVE-2026-48930:\n\tA flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.\n\nThis vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.\n\nCVE-2026-48928:\n\tA inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.\n\nThis vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.\n\nCVE-2026-48816:\n\tsigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.\n\nCVE-2026-48815:\n\tsigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.\n\nCVE-2026-48758:\n\tsigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1.\n\nCVE-2026-48619:\n\tA flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.\n\nThis vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.\n\nCVE-2026-48618:\n\tA flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.\n\nCVE-2026-48617:\n\tA flaw in Node.js Permission Model enforcement allows Bypass via \u0060process.report.writeReport()\u0060 Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.\n\nCVE-2026-48615:\n\tA flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error messages.\n\nWhen proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.\n\nThis vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.\n\nCVE-2026-12151:\n\tThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.\n\nAll releases starting at undici 6.17.0 are affected.\n\nCVE-2026-11824:\n\tSQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.\n\nCVE-2026-11822:\n\tSQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.\n\nCVE-2026-11525:\n\tWhen undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens:\n\nSameSite=NoneOfYourBusiness is parsed as None, the most permissive setting.\nSameSite=StrictLax is parsed as Lax, a downgrade from Strict.\nAffected applications are those that consume Set-Cookie headers from server responses (for example via undici\u0027s fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer\u0027s view of a cookie\u0027s SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.\n\nThis was introduced in undici 5.15.0 when the cookies feature was added.",
  "published": "2026-07-06T09:00:00Z",
  "severity": "important",
  "epss": 0.00144,
  "epssPercentile": 0.03723,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "nodejs24",
      "release": "amzn 2023",
      "fixedVersion": "1:24.18.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1920",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1920",
      "released": "2026-07-06T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:24.18.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1920",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1920",
      "released": "2026-07-06T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1:24.18.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1920",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1920",
      "released": "2026-07-06T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:24.18.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1920",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1920",
      "released": "2026-07-06T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-docs",
      "release": "amzn 2023",
      "fixedVersion": "1:24.18.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1920",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1920",
      "released": "2026-07-06T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-full-i18n",
      "release": "amzn 2023",
      "fixedVersion": "1:24.18.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1920",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1920",
      "released": "2026-07-06T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-libs",
      "release": "amzn 2023",
      "fixedVersion": "1:24.18.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1920",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1920",
      "released": "2026-07-06T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:24.18.0-1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1920",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1920",
      "released": "2026-07-06T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs24-npm",
      "release": "amzn 2023",
      "fixedVersion": "1:11.16.0-1.24.18.0.1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1920",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1920",
      "released": "2026-07-06T09:00:00Z"
    },
    {
      "platform": "linux",
      "product": "v8-13.6-devel",
      "release": "amzn 2023",
      "fixedVersion": "3:13.6.233.17-1.24.18.0.1.amzn2023.0.1",
      "fix": "ALAS2023-2026-1920",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1920",
      "released": "2026-07-06T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}