- CVE-2026-105481: http: close the keep-alive response-queue desynchronisation that the CVE-2026-48931 data guard left open, by checking for bytes already queued in the socket's kernel receive buffer before a free socket is handed to a new request -- that guard is driven by libuv's read callback and so never fires for bytes that arrive after the last event-loop poll, letting a reused socket answer the next request with a response written before it was sent - CVE-2026-105482: dns: reject resolver inputs containing NUL bytes, by routing every resolve method of both the callback and the promises API through validateStringWithoutNullBytes() -- c-ares takes a NUL-terminated C string, so a name such as "example.com\0.trusted.corp" was silently truncated and queried as "example.com" instead - CVE-2026-105483: tls: reject non-canonical IP addresses in server identity checks, so a fullwidth spelling of an address is no longer routed to the DNS-name branch of checkServerIdentity() and matched against a DNS SAN - CVE-2026-106069: tls: same fix -- a host that loosely resolves to an IP address is no longer authenticated by a DNS-name identifier - CVE-2026-106072: tls: same fix -- non-canonical IPv4 spellings such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 and 127.1 answer 0 from net.isIP() and were therefore matched as domain names, letting a DNS SAN authenticate an IP endpoint - CVE-2026-106071: src: fix the fs permission tree node on wildcard nodes, by bounding the prefix walk in FSPermission::RadixTree::Node::NextNode() with the length of the child's prefix instead of the length of the queried path, so a path shorter than the prefix no longer runs off the end of the loop and returns the child as a match on a proper prefix alone - CVE-2026-106073: permission: check the permission model in fs.realpathSync(), which walked the path through binding.lstat(), binding.stat() and binding.readlink() directly instead of the checked public wrappers, so the synchronous walk ran unchecked where realpathSync.native(), fs.realpath() and fs.promises.realpath() all denied - CVE-2026-106074: crypto: reset the randomUUID() and randomInt() entropy caches across snapshots, so a user-land startup snapshot or a single executable application no longer captures a primed cache and replays the same UUIDs and integers in every process launched from it - CVE-2026-111497: deps: cherry-pick brotli 0ed4268a4401, so a block switch in a meta-block that declared NBLTYPES=1 is reported as a format error instead of being returned as BROTLI_FALSE -- which the unsafe decoder path discarded into a tight infinite loop and the safe path turned into a permanent NEEDS_MORE_INPUT, hanging any decode of attacker-supplied Brotli