There are new CVEs came due to pkg:generic/openssl/openssl@3.5.5

[hitendramalviya]

Node version: node:22.22.2-alpine3.23
Severity counts: Critical 1 · High 6 · Medium 0 · Low 0

CVE	Severity	CVSS	EPSS	Installed	Fixed	Exploit	Path	CWEs	Published	Description
CVE-2026-31789	CRITICAL	9.8	2.60e-4	pkg:generic/openssl/openssl@3.5.5	3.5.6	N/A	/usr/local/include/node/openssl/archs/linux-x86_64/no-asm/include/openssl/opensslv.h	CWE-787, CWE-190	2026-03-09	Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input lengt
CVE-2026-28387	HIGH	8.1	3.20e-4	pkg:generic/openssl/openssl@3.5.5	3.5.6	N/A	/usr/local/include/node/openssl/archs/linux-x86_64/no-asm/include/openssl/opensslv.h	CWE-416, CWE-1341	2026-02-27	Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs fo
CVE-2026-2673	HIGH	7.5	1.70e-4	pkg:generic/openssl/openssl@3.5.5	3.5.6	N/A	/usr/local/include/node/openssl/archs/linux-x86_64/no-asm/include/openssl/opensslv.h	CWE-757, CWE-325	2026-02-18	Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's c
CVE-2026-28388	HIGH	7.5	2.10e-4	pkg:generic/openssl/openssl@3.5.5	3.5.6	N/A	/usr/local/include/node/openssl/archs/linux-x86_64/no-asm/include/openssl/opensslv.h	CWE-476	2026-02-27	Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointe
CVE-2026-28389	HIGH	7.5	3.10e-4	pkg:generic/openssl/openssl@3.5.5	3.5.6	N/A	/usr/local/include/node/openssl/archs/linux-x86_64/no-asm/include/openssl/opensslv.h	CWE-476, CWE-166	2026-02-27	Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that ca
CVE-2026-28390	HIGH	7.5	3.10e-4	pkg:generic/openssl/openssl@3.5.5	3.5.6	N/A	/usr/local/include/node/openssl/archs/linux-x86_64/no-asm/include/openssl/opensslv.h	CWE-476	2026-02-27	Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is m
CVE-2026-31790	HIGH	7.5	1.70e-4	pkg:generic/openssl/openssl@3.5.5	3.5.6	N/A	/usr/local/include/node/openssl/archs/linux-x86_64/no-asm/include/openssl/opensslv.h	CWE-754, CWE-824	2026-03-09	Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the