{"id":5329,"date":"2026-11-05T15:39:16","date_gmt":"2026-11-05T15:39:16","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/11\/05\/october-2026-node-js-vulnerabilities-azure-devops-security-guidance\/"},"modified":"2026-11-05T15:39:16","modified_gmt":"2026-11-05T15:39:16","slug":"october-2026-node-js-vulnerabilities-azure-devops-security-guidance","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/11\/05\/october-2026-node-js-vulnerabilities-azure-devops-security-guidance\/","title":{"rendered":"October 2026 Node.js vulnerabilities: Azure DevOps security guidance"},"content":{"rendered":"<p>On October 21, 2026, the Node.js project <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\">released fixes for 10 vulnerabilities<\/a>. These include flaws in DNS resolution and TLS certificate validation, along with a Brotli decompression bug that can corrupt memory and potentially allow code execution when an application processes attacker-controlled data. The fixes shipped in <a href=\"https:\/\/nodejs.org\/en\/blog\/release\/v22.23.4\/\">22.23.4<\/a>, <a href=\"https:\/\/nodejs.org\/en\/blog\/release\/v24.22.1\/\">24.22.1<\/a> and <a href=\"https:\/\/nodejs.org\/en\/blog\/release\/v26.12.1\/\">26.12.1<\/a>, with different affected branches and prerequisites for each CVE.<\/p>\n<p>Azure Pipelines can use Node.js in several contexts, including agent task runners, pipeline-selected tools and application runtimes. Each has a separate update path.<\/p>\n<h2>Vulnerability scope and prerequisites<\/h2>\n<ul>\n<li><strong>DNS resolution and TLS validation.<\/strong> <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases#dnsresolve-truncates-names-containing-nul-char-cve-2026-105482---high\">CVE-2026-105482<\/a> can truncate DNS names containing a NUL character after a full-name security check. <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-ip-is-written-fullwidth-digits-cve-2026-105483---high\">CVE-2026-105483<\/a>, <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-host-loosely-resolves-to-an-ip-address-cve-2026-106069---high\">CVE-2026-106069<\/a> and <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases#improper-certificate-validation-for-non-canonical-ipv4-hostnames-allows-dns-sans-to-authenticate-ip-endpoints-cve-2026-106072---medium\">CVE-2026-106072<\/a> involve unusual IP spellings that can bypass certificate identity checks; the required certificate and resolver conditions differ.<\/li>\n<li><strong>Brotli decompression.<\/strong> <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high\">CVE-2026-111497<\/a> requires malformed, attacker-controlled data to reach an affected decoder. Memory corruption can cause crashes, disclose memory or potentially allow code execution.<\/li>\n<li><strong>HTTP keep-alive response handling.<\/strong> <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases#keep-alive-socket-process-a-response-that-was-written-before-the-request-was-sent-cve-2026-105481---medium\">CVE-2026-105481<\/a> can make a Node.js HTTP client accept unsolicited data on a reused keep-alive connection as the response to a later request.<\/li>\n<li><strong>Startup-snapshot entropy.<\/strong> <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases#cryptorandomuuid-and-randomint-entropy-caches-are-saved-into-user-land-startup-snapshots-and-seas-so-every-process-repeats-the-same-values-cve-2026-106074---medium\">CVE-2026-106074<\/a> can make cached random values repeat across application instances when entropy APIs run during startup-snapshot or snapshot-enabled single executable application creation.<\/li>\n<li><strong>Permission Model and ZIP validation.<\/strong> Under the restricted Permission Model, <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases#permission-model-bypass-with-fsrealpathsync-cve-2026-106073---low\">CVE-2026-106073<\/a> can expose path information and <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases#permission-model-filesystem-over-grant-via-wildcard-radix-lookup-cve-2026-106071---low\">CVE-2026-106071<\/a> can over-grant access for certain wildcard rules. <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases#nodejs-zipfile-returns-attacker-controlled-prefix-bytes-after-failed-zip-header-validation-cve-2026-106070---low\">CVE-2026-106070<\/a> can return attacker-controlled ZIP content after header validation fails.<\/li>\n<\/ul>\n<p>The ZIP and wildcard-grant issues list <strong>Node.js 26 only<\/strong>; the fullwidth-IP issue (<a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases#tls-certificate-hostname-bypass-when-the-ip-is-written-fullwidth-digits-cve-2026-105483---high\">CVE-2026-105483<\/a>) lists <strong>24 and 26<\/strong>. See the <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\">individual advisory sections<\/a> for affected branches and prerequisites. Installation alone does not establish exposure.<\/p>\n<h2>Azure Pipelines remediation guidance<\/h2>\n<ul>\n<li><strong>Self-hosted agents (Azure DevOps Hosted and Azure DevOps On-Prem).<\/strong> Agent <a href=\"https:\/\/github.com\/microsoft\/azure-pipelines-agent\/releases\/tag\/v5.281.1\">v5.281.1<\/a>, released October 23, includes the Node24 update to <strong>24.22.1<\/strong>; not every platform package includes this runner. Use the <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/devops\/pipelines\/agents\/agents?view=azure-devops\">supported agent-pool update process<\/a>, checking product, OS and architecture compatibility first. For Azure DevOps On-Prem, follow <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/devops\/pipelines\/agents\/v5-agent?view=azure-devops\">agent support for your release<\/a> rather than installing this agent release universally. Confirm completion; inspect task diagnostics and verify the selected handler\u2019s binary\/version. The release does not establish fleet rollout or fixes for other runner families.<\/li>\n<li><strong>Microsoft-hosted agents (Azure DevOps Hosted only).<\/strong> <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/devops\/pipelines\/agents\/hosted?view=azure-devops\">Microsoft maintains agents and images<\/a>. You still control Node.js installed or selected by your pipeline steps. Verify the actual job image, agent and selected executable rather than assuming patch status from an image label.<\/li>\n<li><strong>Pipeline-selected Node.js.<\/strong> <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/devops\/pipelines\/tasks\/reference\/use-node-v1?view=azure-pipelines\">UseNode@1<\/a> takes <code>version<\/code>; <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/devops\/pipelines\/tasks\/reference\/node-tool-v0?view=azure-pipelines\">NodeTool@0<\/a> takes <code>versionSpec<\/code>. Both default <code>checkLatest<\/code> to false, so a broad range such as <code>24.x<\/code> can select an older cached patch. Choose an applicable fixed release or later supported patch in the same major line and keep that selection current. Inside the relevant step, check <code>node --version<\/code> and <code>node -p \"process.execPath\"<\/code>. These tasks update <code>PATH<\/code>, not the agent\u2019s embedded task runners.<\/li>\n<li><strong>Tasks and extensions.<\/strong> Publishers should <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/devops\/pipelines\/agents\/nodejs-runners?view=azure-devops\">update handlers and dependencies and test compatibility<\/a>, then <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/devops\/extend\/publish\/overview?view=azure-devops\">publish updated extensions<\/a>. Consumers should use compatible, supported task versions. A newer runner does not make incompatible task code compatible; do not force every task onto Node24.<\/li>\n<li><strong>Containers and deployed applications.<\/strong> <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/devops\/pipelines\/process\/container-phases?view=azure-devops\">Job containers<\/a> can use agent-provided or image\/custom Node.js. Application runtimes need separate servicing. Update affected runtime or image inputs, rebuild and deploy replacements, then verify the running version. Include startup-snapshot and single executable application artifacts where applicable. Host or <code>PATH<\/code> updates do not rewrite image-bundled runtimes or deployed artifacts.<\/li>\n<\/ul>\n<h2>.NET Brotli remediation<\/h2>\n<p>Microsoft\u2019s <a href=\"https:\/\/devblogs.microsoft.com\/dotnet\/dotnet-october-2026-oob-security-updates\/\">October 25 .NET security update announcement<\/a> also covers <a href=\"https:\/\/github.com\/dotnet\/announcements\/issues\/494\">CVE-2026-111497<\/a> in modern .NET. Exposure requires attacker-controlled Brotli reaching an affected decoder through enabled request\/response decompression or explicit Brotli APIs. .NET Framework is not affected by this advisory.<\/p>\n<p><a href=\"https:\/\/github.com\/dotnet\/announcements\/issues\/494\">Fixed modern-.NET runtime baselines<\/a> are <strong>8.0.33, 9.0.22 and 10.0.14<\/strong>, with separate preview guidance. For framework-dependent applications, update the shared runtime and restart; rebuild and redeploy self-contained applications. For <a href=\"https:\/\/learn.microsoft.com\/en-us\/dotnet\/core\/deploying\/native-aot\/\">native ahead-of-time (NativeAOT) applications<\/a>, use the patched SDK and applicable compiler\/runtime packs, then republish and redeploy.<\/p>\n<p>The post <a href=\"https:\/\/devblogs.microsoft.com\/devops\/october-2026-node-js-vulnerabilities-azure-devops-security-guidance\/\">October 2026 Node.js vulnerabilities: Azure DevOps security guidance<\/a> appeared first on <a href=\"https:\/\/devblogs.microsoft.com\/devops\">Azure DevOps Blog<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"<p>On October 21, 2026, the Node.js project released fixes for 10 vulnerabilities. These include flaws in DNS resolution and TLS [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":94,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[3],"tags":[],"class_list":["post-5329","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5329","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=5329"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5329\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/94"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=5329"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=5329"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=5329"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}