An update for nodejs is now available for openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-2820 Final 1.0 1.0 2026-07-06 Initial 2026-07-06 2026-07-06 openEuler SA Tool V1.0 2026-07-06 nodejs security update An update for nodejs is now available for openEuler-20.03-LTS-SP4 Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```(CVE-2025-59465) A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.(CVE-2026-21637) A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.(CVE-2026-21714) An update for nodejs is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP3/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP2/openEuler-24.03-LTS-SP3. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High nodejs https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2820 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-59465 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-21637 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-21714 https://nvd.nist.gov/vuln/detail/CVE-2025-59465 https://nvd.nist.gov/vuln/detail/CVE-2026-21637 https://nvd.nist.gov/vuln/detail/CVE-2026-21714 openEuler-20.03-LTS-SP4 nodejs-12.22.11-11.oe2003sp4.aarch64.rpm nodejs-debuginfo-12.22.11-11.oe2003sp4.aarch64.rpm nodejs-debugsource-12.22.11-11.oe2003sp4.aarch64.rpm nodejs-devel-12.22.11-11.oe2003sp4.aarch64.rpm nodejs-full-i18n-12.22.11-11.oe2003sp4.aarch64.rpm nodejs-libs-12.22.11-11.oe2003sp4.aarch64.rpm npm-6.14.16-1.12.22.11.11.oe2003sp4.aarch64.rpm v8-devel-7.8.279.23-1.12.22.11.11.oe2003sp4.aarch64.rpm nodejs-12.22.11-11.oe2003sp4.src.rpm nodejs-12.22.11-11.oe2003sp4.x86_64.rpm nodejs-debuginfo-12.22.11-11.oe2003sp4.x86_64.rpm nodejs-debugsource-12.22.11-11.oe2003sp4.x86_64.rpm nodejs-devel-12.22.11-11.oe2003sp4.x86_64.rpm nodejs-full-i18n-12.22.11-11.oe2003sp4.x86_64.rpm nodejs-libs-12.22.11-11.oe2003sp4.x86_64.rpm npm-6.14.16-1.12.22.11.11.oe2003sp4.x86_64.rpm v8-devel-7.8.279.23-1.12.22.11.11.oe2003sp4.x86_64.rpm nodejs-docs-12.22.11-11.oe2003sp4.noarch.rpm A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ``` 2026-07-06 CVE-2025-59465 openEuler-20.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H nodejs security update 2026-07-06 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2820 A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped. 2026-07-06 CVE-2026-21637 openEuler-20.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H nodejs security update 2026-07-06 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2820 A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25. 2026-07-06 CVE-2026-21714 openEuler-20.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L nodejs security update 2026-07-06 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2820