Repository navigation
Backport fix for CVE-2026-111497 (brotli block switch) - #25
Conversation
Original commit message: Detect and report invalid stream earlier. PiperOrigin-RevId: 876198329 PR-URL: https://github.com/nodejs-private/node-private/pull/1002 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> CVE-ID: CVE-2026-111497 (cherry picked from commit 67d2947)
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: https://github.com/nodejs-private/node-private/pull/1002 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> CVE-ID: CVE-2026-111497 (cherry picked from commit a18ec92)
9dcf6d7 to
c4fecfb
Compare
|
Semgrep found 1 🟡 Medium severity issue identified in your code: Risk: Affected versions of @babel/helpers, @babel/runtime, @babel/runtime-corejs2, and @babel/runtime-corejs3 are vulnerable to Inefficient Regular Expression Complexity. Babel generates a polyfill (the Fix: Upgrade this library to at least version 7.26.10 at node/deps/cjs-module-lexer/src/package-lock.json:273. Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7806, GHSA-968p-4wvh-cqc8, CVE-2025-27789 Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 2
🟡 Medium severity issue identified in your code: Risk: Affected versions of js-yaml are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). js-yaml is vulnerable to prototype pollution through its YAML merge key ( Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 4.1.1 at node/tools/eslint/package-lock.json:1444. Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-175314, GHSA-mh29-5h37-fv8m, CVE-2025-64718 Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🟠 High severity issue identified in your code: Risk: Affected versions of markdown-it are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. markdown-it is vulnerable to Denial of Service when the Manual Review Advice: A vulnerability from this advisory is reachable if you run Fix: Upgrade this library to at least version 14.3.2 at node/deps/minimatch/package-lock.json:3158. Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104538, GHSA-r7fv-28h4-cvq7, CVE-2026-111759 Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🟠 High severity issue identified in your code: Risk: Affected versions of markdown-it are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. markdown-it processes link reference definitions with an unclosed, multi-line label or title in quadratic time in its block "reference" rule. Passing attacker-controlled Markdown to render() or parse() with default options can block the Node.js event loop (or browser main thread) for many seconds (denial of service). renderInline()/parseInline() do not run the block parser and are not affected; the "zero" preset or md.disable("reference") also avoid the vulnerable rule. Manual Review Advice: A vulnerability from this advisory is reachable if you run Fix: Upgrade this library to at least version 14.3.3 at node/deps/minimatch/package-lock.json:3158. Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105358, GHSA-gfr2-rv44-r23c Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 2
🟠 High severity issue identified in your code: Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. js-yaml is vulnerable to CPU exhaustion when parsing untrusted YAML: the Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 4.3.2 at node/tools/eslint/package-lock.json:1444. Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-69712, GHSA-2883-xcg3-v3hh, CVE-2026-84375 Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 2
🟠 High severity issue identified in your code: Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity. An attacker can supply a YAML document containing a large Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 4.3.1 at node/tools/eslint/package-lock.json:1444. Reference(s): GHSA-5p4m-2wfm-xmqj Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 2
🟠 High severity issue identified in your code: Risk: Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key ( Manual Review Advice: A vulnerability from this advisory is reachable if you are using Fix: Upgrade this library to at least version 4.3.0 at node/tools/eslint/package-lock.json:1444. Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42301, GHSA-52cp-r559-cp3m, CVE-2026-59869 Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🔴 Critical severity issue identified in your code: Risk: Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation. Manual Review Advice: A vulnerability from this advisory is reachable if you use Babel to compile untrusted JavaScript Fix: Upgrade this library to at least version 7.23.2 at node/deps/cjs-module-lexer/src/package-lock.json:344. Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2669, GHSA-67hx-6x53-jw92, CVE-2023-45133 Please reach out to Security (go/sec-inbox) if you need help with this. |
|
Semgrep found 47
🔵 Low severity issue identified in your code: Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper bash array. Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 3 🟡 Medium severity issue identified in your code: Useless call to 'cat' in a pipeline. Use '<' and '>' for any command to read from a file or write to a file. Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🟡 Medium severity issue identified in your code: Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🟡 Medium severity issue identified in your code: Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain file extensions. Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🟡 Medium severity issue identified in your code: Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🟡 Medium severity issue identified in your code: This .npmrc does not set a minimum release age or sets it too low. Newly published packages can be malicious or unstable. Add Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 4 🟡 Medium severity issue identified in your code: This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 12
🟡 Medium severity issue identified in your code: GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 3
🟡 Medium severity issue identified in your code: The use of a weak cryptographic algorithm (e.g., SHA-1 or MD5) has been identified. These algorithms are considered insecure due to vulnerabilities that make them susceptible to collision attacks, allowing attackers to compromise data integrity or security. Replace SHA-1 or MD5 with secure hashing algorithms, such as: SHA-256 or higher (e.g., SHA-3). View Dataflow Graphflowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>lib/_tls_wrap.js</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/Asana/node/blob/c4fecfb7f29ed843c1c193d4134f701414292128/lib/_tls_wrap.js#L1573 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1573] 'sha1'</a>"]
end
%% Intermediate
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/Asana/node/blob/c4fecfb7f29ed843c1c193d4134f701414292128/lib/_tls_wrap.js#L1573 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1573] 'sha1'</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
File0:::invis
%% Connections
Source --> Sink
Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🟡 Medium severity issue identified in your code: Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🟡 Medium severity issue identified in your code: Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🟠 High severity issue identified in your code: NPM registry authentication token detected Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 3 🟠 High severity issue identified in your code: Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file. Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 2 🟠 High severity issue identified in your code: Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. View Dataflow Graphflowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>tools/gyp/pylib/gyp/common.py</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/Asana/node/blob/c4fecfb7f29ed843c1c193d4134f701414292128/tools/gyp/pylib/gyp/common.py#L432 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 432] os.environ.get("CC_target")</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/Asana/node/blob/c4fecfb7f29ed843c1c193d4134f701414292128/tools/gyp/pylib/gyp/common.py#L432 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 432] CC</a>"]
v3["<a href=https://github.com/Asana/node/blob/c4fecfb7f29ed843c1c193d4134f701414292128/tools/gyp/pylib/gyp/common.py#L433 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 433] replace_sep</a>"]
v4["<a href=https://github.com/Asana/node/blob/c4fecfb7f29ed843c1c193d4134f701414292128/tools/gyp/pylib/gyp/common.py#L429 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 429] s</a>"]
v5["<a href=https://github.com/Asana/node/blob/c4fecfb7f29ed843c1c193d4134f701414292128/tools/gyp/pylib/gyp/common.py#L433 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 433] cmd</a>"]
v6["<a href=https://github.com/Asana/node/blob/c4fecfb7f29ed843c1c193d4134f701414292128/tools/gyp/pylib/gyp/common.py#L463 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 463] real_cmd</a>"]
end
v2 --> v3
v3 --> v4
v4 --> v5
v5 --> v6
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/Asana/node/blob/c4fecfb7f29ed843c1c193d4134f701414292128/tools/gyp/pylib/gyp/common.py#L466 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 466] real_cmd</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🟠 High severity issue identified in your code: A Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🟠 High severity issue identified in your code: Using variable interpolation Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 1 🟠 High severity issue identified in your code: Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. Please reach out to Security (go/sec-inbox) if you need help with this. Semgrep found 3
🟠 High severity issue identified in your code: The Python documentation recommends using Please reach out to Security (go/sec-inbox) if you need help with this. |
Cherry-picks nodejs/node@67d294739f and nodejs/node@a18ec92752 from v22.23.4, which together fix CVE-2026-111497.
Based on
v22.21.1, the branch the shipped LunaServer Node binaries are built from (Build Node (Standard) run nodejs#110 and FIPS run #25, both at 0f26935; later commits on this branch only touch build scripts).The conflict in
test/parallel/test-zlib-invalid-input.jswas resolved by keeping only the CVE-2026-111497 regression test. The other tests in that hunk depend on upstream zlib hardening changes this branch doesn't have.