Hi,

The following vulnerabilities were published for nodejs.

CVE-2026-105481[0]:
| A flaw in Node.js HTTP Agent connection reuse can cause a client to
| accept as valid a response that was sent before the client has sent
| the request. This is an incomplete fix of CVE-2026-48931.  The guard
| that destroys idle keep-alive sockets when unexpected data arrives
| only runs when the event loop polls for I/O. If an unsolicited
| response has already reached the socket but has not been read yet
| when the socket is handed to a new request, for example because the
| event loop was busy with synchronous work, the guard is removed
| without seeing it and the data is parsed as the response to the new
| request.  This vulnerability affects Node.js **26.x**, **24.x**, and
| **22.x**.

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#keep-alive-socket-process-a-response-that-was-written-before-the-request-was-sent-cve-2026-105481---medium

CVE-2026-106069[1]:
| A flaw in Node.js TLS hostname verification can cause a server
| certificate to be validated against a different IP address than the
| one the client connected to, when the host is a non-canonical IPv4
| literal with a leading zero, such as `0127.0.0.1`.
| `tls.checkServerIdentity()` normalizes the host following the WHATWG
| URL rules, which read a leading-zero octet as octal (`0127.0.0.1`
| becomes `87.0.0.1`), while the connection is made through the
| operating system resolver, which on some platforms such as macOS
| reads it as decimal (`127.0.0.1`). A server at the connected address
| can then be authenticated with a certificate issued for another IP
| address.  This vulnerability affects Node.js **26.x**, **24.x**, and
| **22.x**.

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-host-loosely-resolves-to-an-ip-address-cve-2026-106069---high

CVE-2026-106072[2]:
| A flaw in Node.js TLS hostname verification allows a certificate
| with only a DNS SAN to authenticate an IP endpoint when the client
| connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`,
| `0x7f.0.0.1`, `2130706433` or `127.1`.  `tls.checkServerIdentity()`
| did not classify these hosts as IP addresses, but normalized them to
| their canonical form and matched the result against the certificate
| DNS names. A certificate containing `DNS:127.0.0.1` and no `IP
| Address:127.0.0.1` SAN was therefore accepted, while the same
| certificate is correctly rejected for `127.0.0.1`. Exploitation
| requires a certificate with a numeric DNS SAN issued by a CA trusted
| by the client, and a platform resolver that accepts these spellings,
| such as glibc.  This vulnerability affects Node.js **26.x**,
| **24.x**, and **22.x**.

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#improper-certificate-validation-for-non-canonical-ipv4-hostnames-allows-dns-sans-to-authenticate-ip-endpoints-cve-2026-106072---medium

CVE-2026-106073[3]:
| A flaw in Node.js Permission Model filesystem enforcement leaves
| `fs.realpathSync()` without the required read permission checks.
| This is an incomplete fix of CVE-2026-21715, which only covered
| `fs.realpathSync.native()`.  As a result, code running under
| `--permission` with restricted `--allow-fs-read` can still use
| `fs.realpathSync()` to check file existence, resolve symlink
| targets, and enumerate filesystem paths outside of permitted
| directories.  This vulnerability affects Node.js **26.x**, **24.x**,
| and **22.x**.

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#permission-model-bypass-with-fsrealpathsync-cve-2026-106073---low

CVE-2026-106074[4]:
| A flaw in Node.js `crypto` causes the internal entropy caches used
| by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and
| `crypto.randomInt()` to be saved into user-land startup snapshots
| (`--build-snapshot`) and single executable applications built with
| `useSnapshot`.  If any of these functions, or an API that relies on
| them such as `URL.createObjectURL()`, is called while the snapshot
| is built, every process started from that snapshot returns the same
| values until the cache is refilled: up to 127 UUIDs and about 1,000
| `randomInt()` values. Identifiers expected to be unique can collide
| across processes, and values issued by one process can be predicted
| by observing another.  This vulnerability affects Node.js **26.x**,
| **24.x**, and **22.x**.

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#cryptorandomuuid-and-randomint-entropy-caches-are-saved-into-user-land-startup-snapshots-and-seas-so-every-process-repeats-the-same-values-cve-2026-106074---medium

CVE-2026-105482[5]:
| A flaw in Node.js DNS resolution allows hostnames containing a NUL
| byte to be silently truncated by the dns.resolve*() functions and
| dns.reverse(). This is an incomplete fix of CVE-2026-48930, which
| only covered dns.lookup() and the net/tls host options.    Because
| the name is passed to c-ares as a C string, resolving
| attacker.example\0.trusted.example queries attacker.example and
| returns its records without any error. Applications that validate a
| hostname, for example against a domain allowlist, and then resolve
| it with dns.resolve*() can act on records for a different name than
| the one they validated.    This vulnerability affects Node.js 26.x,
| 24.x, and 22.x.

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#dnsresolve-truncates-names-containing-nul-char-cve-2026-105482---high

CVE-2026-105483[6]:
| A flaw in Node.js TLS hostname verification allows a certificate
| without a matching IP address SAN to authenticate a connection to an
| IPv4 address when the host is written with non-ASCII characters,
| such as fullwidth digits (`１２７.0.0.1`).  `tls.checkServerIdentity()`
| did not recognize such hosts as IP addresses, even though they
| normalize and resolve to a regular IPv4 address, and matched them
| against the certificate DNS names and Common Name instead. A
| certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could
| therefore be accepted for an IP endpoint it was not issued for. This
| is a regression introduced after the fix for CVE-2026-48618.  This
| vulnerability affects Node.js **26.x** and **24.x**.

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-ip-is-written-fullwidth-digits-cve-2026-105483---high


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-105481
https://www.cve.org/CVERecord?id=CVE-2026-105481
[1] https://security-tracker.debian.org/tracker/CVE-2026-106069
https://www.cve.org/CVERecord?id=CVE-2026-106069
[2] https://security-tracker.debian.org/tracker/CVE-2026-106072
https://www.cve.org/CVERecord?id=CVE-2026-106072
[3] https://security-tracker.debian.org/tracker/CVE-2026-106073
https://www.cve.org/CVERecord?id=CVE-2026-106073
[4] https://security-tracker.debian.org/tracker/CVE-2026-106074
https://www.cve.org/CVERecord?id=CVE-2026-106074
[5] https://security-tracker.debian.org/tracker/CVE-2026-105482
https://www.cve.org/CVERecord?id=CVE-2026-105482
[6] https://security-tracker.debian.org/tracker/CVE-2026-105483
https://www.cve.org/CVERecord?id=CVE-2026-105483

Please adjust the affected versions in the BTS as needed.