Skip to content

Back to the catalog

Paul Dragoonis (@dr4goonis) on X
x.comthread

Paul Dragoonis (@dr4goonis) on X

Social post summarising emergency patches for Node.js (4 high CVEs), PHP (2 critical) and nginx (3 critical). Node.js flaws include a Brotli decoder out-of-bounds write, a DNS truncation bug and two TLS hostname-verification bypasses. PHP has use-after-free and heap corruption bugs, and nginx has alias-rewrite and map-regex heap overflows plus an SSI-AIO use-after-free. It lists the fixed versions for each product.

TL;DR Lists nine new Node.js, PHP and nginx CVEs with severity and the fixed releases to upgrade to.
Open original ↗
Document

What it is

A social post by Paul Dragoonis (@dr4goonis) listing 9 CVEs fixed in emergency releases of three products. The post says Node.js and PHP patches came out "yesterday" and the NGINX patches "last week". It gives no post date, so the timing is relative to when it was written.

Affected

Node.js (rated High by the post):

  • CVE-2026-111497: Brotli decoder out-of-bounds write.
  • CVE-2026-105482: DNS truncation bug.
  • CVE-2026-105483: TLS certificate hostname bypass via full-width digits.
  • CVE-2026-106069: TLS certificate hostname bypass via loose resolution.

PHP (Critical):

  • CVE-2026-109619: stale global state use-after-free.
  • CVE-2026-109618: out-of-memory heap corruption.

NGINX (Critical):

  • CVE-2026-15176: alias-rewrite heap overflow.
  • CVE-2026-93479: map-regex heap overflow.
  • CVE-2026-97205: SSI-AIO use-after-free.

The two Node.js TLS bypasses matter for any service that validates server certificates by hostname. The NGINX issues are tied to specific features: alias and rewrite, map with regex, and SSI with AIO. The post does not say which configurations are exploitable.

What to do

The post says to upgrade immediately to one of these fixed versions, depending on your release line:

Node.js: 22.23.4, 24.22.1, or 26.12.1
PHP:     8.2.35, 8.3.36, 8.4.27, or 8.5.12
NGINX:   1.30.6 or 1.31.8

Check each runtime on your hosts, containers and base images against these numbers. A release line not listed (for example PHP 8.1 or older, or other Node.js majors) is not addressed by the post.

Caveats

The post is a summary, not an advisory. It gives no CVSS scores, affected version ranges, exploitation status, workarounds or links to vendor bulletins. The severity labels (High, Critical) are the author's grouping. Confirm each CVE against the Node.js, PHP and NGINX security announcements before prioritising. The post carries a "#php2shell" hashtag but does not explain it.

CVEs named here

Technologies named here

Techniques named here

  • Brotli decoder out-of-bounds write
  • DNS truncation bug
  • TLS certificate hostname bypass via full-width digits
  • TLS certificate hostname bypass via loose resolution
  • Stale global state use-after-free
  • Out-of-memory heap corruption
  • Alias-rewrite heap overflow
  • Map-regex heap overflow
  • SSI-AIO use-after-free
  • Use-after-free

Threat actors named here

Related in AppSec