- CVE-2021-22931: c-ares: escape more characters in ares_expand_name(), so a crafted domain name cannot inject into the decoded string. Names that fail the new hostname check - a CNAME, NS or PTR target with a character outside [A-Za-z0-9-*._/] - now make the resolve call fail with EBADRESP instead of returning the attacker-supplied string - CVE-2022-21824: console: fix prototype pollution via console.table - CVE-2022-32212: inspector: reject malformed IP addresses in the Host check that octal and other non-canonical forms could slip past - CVE-2022-43548: inspector: harden the same check with inet_pton(), closing the forms CVE-2022-32212 left open - CVE-2025-55131: buffer: remove the zero-fill toggle, so an application that replaces the global ArrayBuffer cannot make Buffer.alloc return dirty memory - CVE-2021-22930: http2: use-after-free when a stream is cancelled while nghttp2 is still processing it - CVE-2021-22940: http2: complete the CVE-2021-22930 fix, which left the same free reachable through a second path - CVE-2023-44487: http2: rate-limit the HTTP/2 Rapid Reset pattern in bundled nghttp2, so repeated stream resets cannot pin the server - CVE-2024-27983: http2: do not leave a destroyed session's streams pointing at freed memory - CVE-2026-48619: http2: bound a client's originSet, which a malicious server could otherwise grow without limit - CVE-2026-48937: http2: release the session when a non-h2 client aborts, instead of pinning it until the timeout. Carries upstream's follow-up as well: without it a peer that first sends GOAWAY(NO_ERROR) makes the session close itself, which set goaway_initiated_ for good and also disarmed the 120s reaper, so the detection above could never fire again on that session - CVE-2026-56846: http2: avoid the reset-stream path that leaves the session readable after teardown - CVE-2026-56848: http2: defer RST_STREAM while in scope, so flushing pending data cannot re-enter nghttp2 and free a stream still in use - CVE-2021-44531: tls: reject a certificate whose URI subject alternative name matches the host, which checkServerIdentity() accepted - CVE-2023-30590: crypto: document that diffieHellman.generateKeys() does not replace a private key that was already set, so callers cannot be misled into reusing one - CVE-2023-46809: crypto: do not leak PKCS#1 v1.5 padding failures through timing (Marvin attack). API break on el7, el9 and el10, which link alt-openssl11: there the OpenSSL has no implicit rejection, so crypto.privateDecrypt() with RSA_PKCS1_PADDING now throws ERR_INVALID_ARG_VALUE instead of decrypting, as upstream shipped it. el10 is in that set as of 10.24.1-9, which moved it off the system OpenSSL 3.x onto alt-openssl11. el8 keeps working unchanged: its system 1.1.1k carries the implicit-rejection backport. A process that needs the old behaviour on el7, el9 or el10 can start node with --security-reverts=CVE-2023-46809 - CVE-2025-59465: tls: do not let a single RST connection tear down a tls.createServer or http2.createSecureServer listener - CVE-2026-21637: tls: survive a ClientHello carrying an unexpected server_name instead of terminating the server - CVE-2026-48933: crypto: the published defect is in WebCrypto, which node 10 does not have; the same signed-int output-length overflow in the legacy CipherBase::Update() path is hardened with upstream's TryGetIntCipherOutputLength() - CVE-2021-27290: npm: bundled ssri regular expression could be driven exponential by a crafted integrity string - CVE-2021-23362: npm: bundled hosted-git-info shortcut regular expression could be driven exponential by a crafted shortcut URL, which npm-package-arg reaches from any dependency specification. Fixed by the same upstream npm upgrade as CVE-2021-27290 above - CVE-2021-37701, CVE-2021-37712: npm: bundled node-tar followed a symlink out of the extraction directory when a crafted archive reused a directory name - CVE-2021-37713: npm: bundled node-tar could be made to write outside the extraction directory through a crafted drive-relative path. Fixed by the same node-tar 4.4.13 -> 4.4.19 upgrade as CVE-2021-37701 and CVE-2021-37712 - CVE-2021-32803: npm: bundled node-tar checked a cached directory entry rather than the filesystem, so a crafted archive could replace a directory with a symlink and write through it. Fixed by the same node-tar upgrade - CVE-2021-32804: npm: bundled node-tar stripped absolute paths with a rule a crafted archive could evade, letting an entry be written outside the extraction directory. Fixed by the same node-tar upgrade - CVE-2021-23343: npm: bundled path-parse split a path with regular expressions that could be driven exponential by a crafted path string, which resolve reaches during module resolution. Fixed by the same upstream npm upgrade as CVE-2021-37701 and CVE-2021-37712 above - CVE-2025-59466: async_hooks: re-throw a stack-overflow RangeError to the JavaScript caller instead of exiting with code 7, so a stack overflow raised under an enabled async_hooks hook can be caught by try/catch and reaches process.on('uncaughtException'), as it does with no hooks enabled - packaging: correct v8_postfix from node.52 to node.59, the embedder string 10.24.1 actually carries, so process.versions.v8 and Provides: bundled(v8) agree with the binary - packaging: the check scriptlet ran under scl without set -e, so only the last of its five version assertions could fail a build - which is how the v8 version above stayed wrong - and it ran no tests at all. It now fails on the first error and runs every regression test carried by a CVE patch here; the inspector C++ test cases run from the build scriptlet, which has the toolchain - packaging: key the two OpenSSL-dependent test exclusions on the OpenSSL we link rather than on the EL version. ALTEAPLN-111 moved el10 onto alt-openssl11, so test-crypto-dh and test-crypto-rsa-dsa, which only an OpenSSL 3 refuses, now run there too; el8 is the one platform still on a system OpenSSL, and the only one where CVE-2025-59465 and CVE-2026-21637 ship without their regression test