HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58044
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
51–56 of 56 matching · newest first
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58044
trace_events.createTracing().enable() Writes Trace Logs Outside --allow-fs-writeruntime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-56847
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-56850
nghttp2_session_mem_send() during nghttp2_session_mem_recv() causes heap-use-after-free in Node.js HTTP/2runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-56848
runtime node · Upgrade to 26.5.1 or 24.18.1 by release line · >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58041
runtime node · Upgrade to 26.5.1, 24.18.1 or 22.23.2 by release line · >= 22.0.0, < 22.23.2; >= 24.0.0, < 24.18.1; >= 26.0.0, < 26.5.1 · CVE-2026-58040
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.