Provenance Record

Highly technical, precise News piece (866 words) covering 11 CVEs across 3 severity tiers with correct per-CVE attribution. Appropriately structured (Overview/What We Know/What We Don't Know/Analysis) and correctly distinguishes CNA-assessed vs. NVD-assessed CVSS scores rather than conflating them.

Read all 5 sources in full. Node.js blog: confirms both delay-announcement quotes verbatim ('due to the need for additional testing and validation' / 'due to infrastructure issues'), the three release versions (v22.23.2/v24.18.1/v26.5.1), all 8 CVE technical descriptions verbatim (CVE-2026-56846 retained-header memory exhaustion, CVE-2026-56848 nghttp2 heap-use-after-free, CVE-2026-58043 Permission Model radix-tree bypass, CVE-2026-56847/58039 Permission Model write-outside-allowlist bugs, CVE-2026-56850 PFX key collision, CVE-2026-58040 incomplete fix for CVE-2026-48934, CVE-2026-58041 StatementSyncIterator, CVE-2026-58042 DNS resolveAny 256-record abort, CVE-2026-58045 spoofed TypedArray byteLength, CVE-2026-58044 HTTP parser desync), and the undici (8.9.0/7.29.0/6.28.0) and llhttp (9.4.3) dependency bumps. HeroDevs: confirms the 'Permission Model bypasses have now appeared in every Node.js security release of 2026' quote, the April 2025/April 2026 Node 18/20 EOL dates, and the 103.8M/32.7M/136M July download figures, all verbatim. Digital Applied: confirms 'Node 20 and every earlier line are End-of-Life and receive no patches from this release' and 'can enable request smuggling' verbatim. Both NVD pages independently confirmed: CVE-2026-58043 shows CNA (HackerOne) Base Score 7.5 HIGH with vector AV:L/AC:H (local access, high complexity) and 'NVD assessment not yet provided' for both CVSS 3.x and 4.0 — exactly as the article states. CVE-2026-56848 shows the same CNA score structure with vector AV:N/AC:L/PR:N/UI:N (network-exploitable, no auth, no user interaction) — also an exact match. The internal link to the June 2026 Node.js security release article resolves to an existing published article. No misattributions, fabricated quotes, or numeric errors found anywhere.

Every specific — CVE numbers, severities, technical mechanisms, CVSS vectors, version numbers, download figures, dates — traces exactly to its cited source. This is a technically dense article where small transcription errors would be easy to make, and none were found.

The only automated flag was a source-allowlist gap, not a content problem. Every claim — including unusually precise technical details like CVSS vector strings — was independently verified against the source snapshots and found accurate. Approving outright.