SKYLINE Blog

Security advisory Debian

Node.js security updates for Debian 13 and 12 (DSA-6517-1, DLA-4809-1): HTTP/2, TLS and permission fixes

Debian backported fixes from Node.js's June and July 2026 security releases to its Node 20 and 18 packages. The October 2026 issues are still open.

Published
Reading time
4 min read

Security advisory Vulnerability

Severity: High Status: Patched
CVE IDs
Status
Fixed versions are available for Debian 13 (trixie) and Debian 12 (bookworm).
Affected
  • nodejs in Debian 13 (trixie) before 20.19.2+dfsg-1+deb13u3
  • nodejs in Debian 12 (bookworm) before 18.20.4+dfsg-1~deb12u3
Published
Updated

What you should do

  • Upgrade nodejs to 20.19.2+dfsg-1+deb13u3 or 18.20.4+dfsg-1~deb12u3 and restart every Node.js service.
  • Put HTTP/2 and TLS endpoints behind a reverse proxy where you can, and keep request size and timeout limits in place.
  • Do not rely on the Permission Model as your only sandbox for untrusted code.
  • For long-lived applications, plan a move to a Node.js line that upstream still supports (22, 24 or 26) from a source you can update quickly.
  • Watch the nodejs tracker page for the October 2026 fixes.
Timeline
  1. Debian published DSA-6517-1 for nodejs.
  2. The Debian LTS team published DLA-4809-1 for nodejs.
  3. Skyline published this summary.

Debian has backported fixes from the Node.js project's June and July 2026 security releases into its own Node.js packages: DSA-6517-1 for Debian 13 (trixie) on 26 September 2026 and DLA-4809-1 for Debian 12 (bookworm) on 1 October. They cover HTTP/2 memory and use-after-free bugs, TLS hostname-verification bypasses and Permission Model escapes. If you deploy Node.js applications from Debian's nodejs package, this update applies to you.

At a glance

ItemDetails
Source packagenodejs (binary packages nodejs and libnode115 on trixie, libnode108 on bookworm)
Fixed versions20.19.2+dfsg-1+deb13u3 (trixie), 18.20.4+dfsg-1~deb12u3 (bookworm)
AdvisoriesDSA-6517-1 (26 Sep 2026, 17 CVEs), DLA-4809-1 (1 Oct 2026, 11 CVEs)
Example CVEsCVE-2026-48618, CVE-2026-48933, CVE-2026-56846, CVE-2026-56848, CVE-2026-58043
SeverityHigh (Node.js rates the most serious fixes high)
Known exploitationNone in CISA KEV (30 Oct 2026)

What the vulnerabilities are

Debian sums up the trixie fixes as denial of service, permission model bypass, incorrect certificate validation or information disclosure; the bookworm DLA lists the same categories without the permission model. The underlying issues come from the Node.js June 2026 and July 2026 security releases:

  • Remote crashes and memory exhaustion (high). CVE-2026-56846 lets retained HTTP/2 header blocks get around maxSessionMemory; CVE-2026-56848 is a heap use-after-free when HTTP/2 sending is re-entered during receive; CVE-2026-48933 aborts the process through an integer overflow in WebCrypto AES. CVE-2026-58042 can abort dns.resolveAny() on responses with many A records.
  • TLS identity checks. CVE-2026-48618 (high) can bypass wildcard-depth hostname checks through Unicode dot separators. CVE-2026-48928, CVE-2026-48934 and CVE-2026-56850 concern SNI case matching, session reuse with a different server name and reuse of mTLS identities across certificates.
  • Permission Model. CVE-2026-58043 (high) can over-grant filesystem access under --permission. This matters only if you use Node's --permission flags to restrict what code can access.
  • HTTP client behaviour. CVE-2026-48930 (NUL bytes in hostnames) and CVE-2026-48931 (a response-queue race in http.Agent).

Why Debian's Node.js is different

Debian 13 ships Node.js 20 and Debian 12 ships Node.js 18. According to the Node.js release schedule, upstream support for Node.js 18 ended on 30 April 2025 and for Node.js 20 on 30 April 2026, and the June and July 2026 posts announce new versions only for the 22.x, 24.x and 26.x lines, noting that end-of-life versions are always affected when a security release occurs. Debian keeps its own packages patched by backporting, which takes time and is not always complete: on 31 October 2026 the Debian tracker listed several CVEs from Node.js's October 2026 security release, such as CVE-2026-106072 in TLS hostname verification, as still open for both releases.

Are you affected?

apt policy nodejs
node --version
dpkg -l nodejs 'libnode*' | grep '^ii'

Debian's package reports v20.19.2 or v18.20.4; the Debian revision in apt policy tells you whether the fix is installed. If node --version shows 22.x or later, your Node.js does not come from Debian's archive (for example NodeSource or official binaries) and you should follow the upstream releases instead.

How to update

sudo apt update
sudo apt install --only-upgrade nodejs libnode115   # Debian 13
sudo apt install --only-upgrade nodejs libnode108   # Debian 12

Restart or reboot?

No reboot. Every running Node.js process keeps the old code until it restarts, so restart your application services, for example sudo systemctl restart myapp for a systemd unit, or your process manager's restart command.

Sources

Topics

SKYLINE Engineering

@skyline

The engineering team at SKYLINE Industrial Solutions. We publish field-tested guides drawn from real KSA and GCC deployments.

See author profile
More in Debian

Related: Skyline Nexus ERP guides

Nexus knowledge base →
Skyline Nexus ERP

Gulf & Middle East tax and e-invoicing guides

VAT, ZATCA e-invoicing and corporate tax explained for Saudi Arabia, the UAE and the wider GCC.

 Skyline Nexus ERP

Skyline Nexus ERP — cloud accounting & ZATCA e-invoicing

Our cloud ERP: accounting, invoicing, inventory and POS in one place. First month free.
SKYLINE engineering services

Need this implemented for you?

Reading is free — building it right takes a team. SKYLINE engineers ship Debian for Aramco vendors, banks, hospitals and government agencies across Saudi Arabia. Talk to us before you start.

Server Infrastructure Dell, HPE, Huawei, VMware, Hyper-V, HCI IT AMC Annual maintenance, 24/7 SLA, Bronze→Platinum
Talk to a SKYLINE engineer Call +966 50 993 9334
Aramco Approved Contractor ISO 9001 · ISO 27001 SAMA CSF aligned NCA ECC ready 247+ KSA clients

Comments

0 total · 0 threads
Be the first to leave a comment.