PR-URL: #63263

PR-URL: #63703
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

This seems like a bug in AIX header files because the examples
show including the headers but upon inspecting these files there
are no declarations for sendmmsg and others:

https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine

For now we can claim to not have these functions.
Alternatively we can declare these ourselves if we are AIX 7.2 or newer.

The actual functions look to be available in libc.

GCC also has the same implicit function declaration but
it happily moves forward.

Clang started making this an explict error in clang 16:

https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16

PR-URL: #62656
Refs: https://www.ibm.com/docs/en/aix/7.2.0?topic=s-sendmmsg-subroutine
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

PR-URL: #63820
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>

PR-URL: #63820
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>

PR-URL: #62891
Backport-PR-URL: #63164
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

This is a set of src & tests fixes for nghttp2 due to changes in
v1.67.0+ which require a selection of changes to how we handle
low-level protocol errors when using the latest versions of nghttp2,
changing both some src error handling and updating some tests to match.

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: #62891
Backport-PR-URL: #63164
Reviewed-By: Tim Perry <pimterry@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Refs: https://hackerone.com/reports/3658225
CVE-ID: CVE-2026-48937

PR-URL: nodejs-private/node-private#890
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

Refs: https://hackerone.com/reports/3720313
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: nodejs-private/node-private#867
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
CVE-ID: CVE-2026-48615

Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: nodejs-private/node-private#870
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48617
Refs: https://hackerone.com/reports/3625987

Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: nodejs-private/node-private#869
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48618
Refs: https://hackerone.com/reports/3688064

A malicious HTTP/2 server can send repeated ORIGIN frames with unique
origins, causing unbounded growth of the client-side originSet for the
lifetime of the session. Cap the set at 128 entries; once full, new
origins from ORIGIN frames are silently dropped.

Refs: https://hackerone.com/reports/3676863
PR-URL: nodejs-private/node-private#855
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48619

The regex constructed by server.addContext() lacked the case-insensitive
flag, causing uppercase or mixed-case SNI hostnames from ClientHello to
miss their intended context and fall back to the default context. This
violates RFC 6066 Section 3, which states that DNS hostnames are
case-insensitive. In mTLS configurations with per-tenant contexts, this
allowed bypassing client certificate authorization by simply
uppercasing the SNI hostname.

Add the 'i' flag to the RegExp in addContext() so that SNI matching
is case-insensitive.

PR-URL: nodejs-private/node-private#857
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48928
Refs: https://hackerone.com/reports/3656869

Ref: https://hackerone.com/reports/3656716
PR-URL: nodejs-private/node-private#868
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48930
Refs: https://hackerone.com/reports/3656716

PR-URL: nodejs-private/node-private#873
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48935
Refs: https://hackerone.com/reports/3625987

Attach a data guard listener on idle keepAlive sockets in the
freeSockets pool. If unsolicited data arrives while the socket
is idle, destroy it immediately to prevent response queue poisoning.

Refs: https://hackerone.com/reports/3582376
PR-URL: nodejs-private/node-private#846
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48931
Refs: https://hackerone.com/reports/3582376

Reject WebCrypto cipher operations whose computed output length would
exceed INT_MAX before passing the length to OpenSSL.

This avoids signed overflow in the AES and ChaCha20-Poly1305 one-shot
cipher paths and turns oversized inputs into a clean operation failure.

Refs: https://hackerone.com/reports/3760016
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: nodejs-private/node-private#878
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48933

Backport-PR-URL: nodejs-private/node-private#895
PR-URL: nodejs-private/node-private#854
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
CVE-ID: CVE-2026-48934
Refs: https://hackerone.com/reports/3649802

Backport-PR-URL: nodejs-private/node-private#895
PR-URL: nodejs-private/node-private#854
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Refs: https://hackerone.com/reports/3649802

This is a security release.

Notable changes:

* (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High
* (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High
* (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium
* (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium
* (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium
* (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium
* (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium
* (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium
* (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low
* (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low
* (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low

PR-URL: nodejs-private/node-private#899