CVE-2026-106072

Vendor

Canonical

Product

canonical

CVSS

6.7

EPSS

0.005 (p41)

Exposure class

Developer platform, Network management

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 51
   Advisory Fortinet PSIRT 6d ago

   Node2Shell CVEs

   CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js…

   CVSS 9.8 CVE-2026-105482CVE-2026-105483CVE-2026-106069+7 more Fortinet Node.js
2. 24
   Qualys TRU Qualys 8d ago

   Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

   Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write…

   Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+7 more Node.js
3. 20
   CVE NVD 8d ago

   A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a…

   A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or…

   CVSS 6.7 CVE-2026-106072 Canonical
4. 21
   Qualys TRU Qualys 4d ago

   Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

   Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3…

   No fix yet CVE-2026-111497CVE-2026-106069CVE-2026-105483+6 more Qualys Node.js