From 968311069f85bf3d5d84654102e006dfe22c85a7 Mon Sep 17 00:00:00 2001 From: inoway46 Date: Sun, 25 Oct 2026 01:37:55 +0900 Subject: [PATCH 1/2] doc: list CVE-2026-106072 in v22 changelog The non-canonical IP address fix also addresses CVE-2026-106072. Record both CVE IDs in the v22.23.4 notable changes. Refs: https://github.com/nodejs/node/issues/66981 Assisted-by: a closed-source coding agent Signed-off-by: inoway46 --- doc/changelogs/CHANGELOG_V22.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/changelogs/CHANGELOG_V22.md b/doc/changelogs/CHANGELOG_V22.md index 2c030ec425f9..f9955d716dee 100644 --- a/doc/changelogs/CHANGELOG_V22.md +++ b/doc/changelogs/CHANGELOG_V22.md @@ -90,7 +90,7 @@ This is a security release. * (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) * (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) -* (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina) +* (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) * (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) * (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) * (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel) From eaf1f95d69b8ddfe200645973f3d51d3dc9912a6 Mon Sep 17 00:00:00 2001 From: inoway46 Date: Sun, 25 Oct 2026 01:37:55 +0900 Subject: [PATCH 2/2] doc: list CVE-2026-106072 in v24 changelog The non-canonical IP address fix also addresses CVE-2026-106072. Record both CVE IDs in the v24.22.1 notable changes. Refs: https://github.com/nodejs/node/issues/66981 Assisted-by: a closed-source coding agent Signed-off-by: inoway46 --- doc/changelogs/CHANGELOG_V24.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/changelogs/CHANGELOG_V24.md b/doc/changelogs/CHANGELOG_V24.md index 3188a604c032..8cb2153e8702 100644 --- a/doc/changelogs/CHANGELOG_V24.md +++ b/doc/changelogs/CHANGELOG_V24.md @@ -85,7 +85,7 @@ This is a security release. * (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) * (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) * (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) -* (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina) +* (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) * (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) * (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) * (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel)