Alpine: nodejs: security update to 22.23.5-r0

high Tenable Cloud Security Plugin ID 479025

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS
1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-
certificate policies per hostname, for example stricter admin-only client-cert auth on one host and
ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the
TLS 1.2 connection under a different servername and carry its existing authentication to the protected
host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
(CVE-2026-123872)

- A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server,
over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated
header buffers to outlive its session: the stream is removed from the session's stream set but never
detached, so when ~Http2Session() runs the memory accounting is nonzero and the
CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a
default http2 server whose handler responds before the request body has ended, which is typical. It is a
variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still
tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
(CVE-2026-123863)

- A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both
TLS and cleartext, by cancelling file downloads. When the server serves a file with
stream.respondWithFile() or stream.respondWithFD() and the client cancels the request, a StreamPipe used
for the transfer is torn down in an order that leaves a NULL pointer which is then dereferenced, aborting
the process. No crafted frames are needed, and a handful of cancelled requests against a default file-
serving handler is enough. This vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123875)

- An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a
peer triggers a protocol error, for example an oversized frame header, while the session is already
shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling
session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in
memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by
sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case
of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not
shutting down, but missed terminations that arrive while the session is already shutting down. This
vulnerability affects Node.js 26.x, 24.x, and 22.x. (CVE-2026-123865)

- A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker
corrupt process memory. When an application passes an attacker-controlled value such as a request's
:authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a
buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end
of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-
of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This
vulnerability affects Node.js 26.x and 24.x. (CVE-2026-123828)

Solution

Update the nodejs library and its related packages to version 22.23.5-r0 or later.

Plugin Details

Severity: High

ID: 479025

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 11/12/2026

Updated: 11/12/2026

Supported Sensors: Agentless Assessment

Risk Information

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N

CVSS Score Source: CVE-2026-123872

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-123863

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 11/11/2026

Reference Information

CVE: CVE-2026-123828, CVE-2026-123829, CVE-2026-123862, CVE-2026-123863, CVE-2026-123864, CVE-2026-123865, CVE-2026-123866, CVE-2026-123867, CVE-2026-123868, CVE-2026-123871, CVE-2026-123872, CVE-2026-123873, CVE-2026-123874, CVE-2026-123875, CVE-2026-123877

Detections

Analytics