VSA-2026-054: Multiple Node.js vulnerabilities
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-10-29 | 2026-10-29 | 🔴 Important | Not available yet | - Xen Orchestra / Xen Orchestra Appliance |
Multiple vulnerabilities have been discovered in Node.js impacting Xen Orchestra as it runs as a Node.js process. We classify the impact as Important. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
There are four vulnerabilities affecting Xen Orchestra and Xen Orchestra Appliance which run Node.js 22.22.2.
Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high)​
A flaw in the Brotli decoder bundled with Node.js allows malformed compressed input to write past the end of an internal decoder buffer.
An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer. An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.
TLS certificate hostname bypass when the host loosely resolves to an IP address (CVE-2026-106069) - (high)​
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1.
tls.checkServerIdentity() normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (0127.0.0.1 becomes 87.0.0.1), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (127.0.0.1). A server at the connected address can then be authenticated with a certificate issued for another IP address.
Keep-alive socket process a response that was written before the request was sent (CVE-2026-105481) - (medium)​
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931.
The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request.
Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (CVE-2026-106072) - (medium)​
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 or 127.1.
tls.checkServerIdentity() did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing DNS:127.0.0.1 and no IP Address:127.0.0.1 SAN was therefore accepted, while the same certificate is correctly rejected for 127.0.0.1. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.
Impact​
An adversary able to send crafted Brotli data to Xen Orchestra, for example by tampering with compressed backup data on a backup repository they can write to, can corrupt its memory when that data is decompressed, leading to a crash, disclosure of process memory, or remote code execution with the privileges of xo-server (root). Under specific conditions, an adversary positioned between Xen Orchestra and an XCP-ng host can also impersonate that host through the TLS hostname verification bypasses, provided they hold a certificate with a numeric DNS name issued by a CA that Xen Orchestra trusts. A malicious server can also inject an HTTP response that Xen Orchestra accepts as the answer to a later request on the same connection.
Affected Versions​
- Xen Orchestra before 6.9.1: Affected.
- Xen Orchestra Appliance: Affected.
Status​
- Released
Mitigations​
Security fixes are delivered to the latest channel before the stable channel. Switching to latest therefore allows earlier remediation, although this channel may be less stable. However, security fixes have been delivered to the stable channel for these issues.
There are mitigations available to reduce the risk of exploitation of certain vulnerabilities.
Xen Orchestra and Xen Orchestra Appliance​
- Expose Xen Orchestra only on a dedicated and isolated administration network
- Declare XCP-ng hosts using their canonical IPv4 address (for example 192.168.1.10, not 0192.168.1.10 or 3232235786)
- Use trusted backup remote only
To detect exploitation attempts, look in the audit log for disk.import / vm.import calls with a url parameter, and watch for unexpected xo-server crashes.
Resolution​
If Xen Orchestra was installed from source, it is strongly recommended to upgrade Node.js to version 2.23.4 or later.
As of 2026-10-29, Xen Orchestra Appliance version 6.10.0 has been released and includes the fix for these issues. It is currently available on the latest channel and on the stable channel.
List of packages fixing these issues:
- node: 22.23.4