DeOccultist

It's time to update your node.js on your XO instances.

Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues.

This security release includes the following dependency updates to address public vulnerabilities:

c-ares on 26.x, 24.x, 22.x
ca-cert (eMudhra Intermediate CA Compromise) on 26.x, 24.x, 22.x
OpenSSL on 24.x, 22.x
SQLite on 22.x
Undici on 26.x, 24.x, 22.x

dns.resolve truncates names containing NUL char (CVE-2026-105482) - (high)
This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to hasanfleyah for reporting this vulnerability and thank you jasnell for fixing it.

TLS certificate hostname bypass when the IP is written fullwidth digits (CVE-2026-105483) - (high)
This vulnerability affects Node.js 26.x and 24.x.

Thank you, to hasanfleyah for reporting this vulnerability and thank you jasnell for fixing it.

TLS certificate hostname bypass when the host loosely resolves to an IP address (CVE-2026-106069) - (high)
This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to anagnorisis2peripeteia for reporting this vulnerability and thank you mcollina for fixing it.

Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high)

A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to mcollina for reporting this vulnerability and thank you aduh95 for fixing it.

Keep-alive socket process a response that was written before the request was sent (CVE-2026-105481) - (medium)

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to hasanfleyah for reporting this vulnerability and thank you jasnell for fixing it.

Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (CVE-2026-106072) - (medium)
This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to br41ny for reporting this vulnerability and thank you mcollina for fixing it.

crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (CVE-2026-106074) - (medium)
This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to gesposito for reporting this vulnerability and thank you panva for fixing it.

Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation (CVE-2026-106070) - (low)

This vulnerability affects Node.js 26.x.

Thank you, to startimeash for reporting this vulnerability and thank you mcollina for fixing it.

Permission Model filesystem over-grant via wildcard radix lookup (CVE-2026-106071) - (low)
This vulnerability affects Node.js 26.x.

Thank you, to malikhamzaiqbal for reporting this vulnerability and thank you jasnell for fixing it.

Permission Model bypass with fs.realpathSync (CVE-2026-106073) - (low)
This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to 0xoroot for reporting this vulnerability and thank you RafaelGSS for fixing it.

Downloads and release details

Node.js v22.23.4
Node.js v24.22.1
Node.js v26.12.1

Summary

The Node.js project will release new versions of the 26.x, 24.x, 22.x releases lines on or shortly after, Wednesday, October 21, 2026 in order to address security vulnerabilities.

The highest severity issue fixed in this release is HIGH.
Impact

The highest severity issue fixed in the 26.x release line is HIGH.
The highest severity issue fixed in the 24.x release line is HIGH.
The highest severity issue fixed in the 22.x release line is HIGH.

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

@omatsei said:

@omatsei I figured out the problem. There appears to be a bug in XO that requires you to check "Check Certificate" and/or "Start TLS", save the configuration, then uncheck them, then save again. Then it should work. The bug is that they're unchecked by default, but apparently they're enabled in the background.

Thanks for that, I was stump on this one trying to reconfigure a new instance.
This is defintely the case even with the latest auth-ldap (v0.10.11) plugin.

@uberiain said in XCP-ng Center 25.04 Released:

Hi, with this modification on MainWindow.cs in

    private List<TabPage> GetNewTabPages()

adding this at the end:

This will add the tab back in XCP-ng Center but I don't think it works in XCP-ng 8.3.
I just upgraded from 8.2.1 to 8.3 when I logged into XCP-ng Center I saw the error message

Active Directory authorization is not available","Server 'xcp-ng-TEST' has failed to connect to the Active Directory server.

INTERNAL_ERROR: [ Xapi_systemctl.Systemctl_fail(""INTERNAL_ERROR: [ Subprocess exited with unexpected code 1; stdout = [  ]; stderr = [ Job for winbind.service failed because the control process exited with error code. See \""systemctl status winbind.service\"" and \""journalctl -xe\"" for details.\n ] ]"") ]","xcp-ng-TEST","Jul 11, 2025 3:58 PM","

# systemctl status winbind.service 

winbind.service - Samba Winbind Daemon
   Loaded: loaded (/usr/lib/systemd/system/winbind.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Fri 2025-07-11 16:01:28 AEST; 3min 15s ago
     Docs: man:winbindd(8)
           man:samba(7)
           man:smb.conf(5)
 Main PID: 9593 (code=exited, status=1/FAILURE)
   Status: "Starting process..."

I haven't figured out what to do yet. None of the users can log into XCP-ng Center using their Active Directory credentials and only root can log in.

EDIT: Actually winbind wasn't even used in XCP-ng 8.2.1, I'm not sure why this service started up in 8.3.

XCP-ng 8.2.1# systemctl status winbind.service
● winbind.service - Samba Winbind Daemon
   Loaded: loaded (/usr/lib/systemd/system/winbind.service; disabled; vendor preset: disabled)
   Active: inactive (dead)
     Docs: man:winbindd(8)
           man:samba(7)
           man:smb.conf(5)

But I can see that windbind is used for XenServer 8.4 https://docs.xenserver.com/en-us/xenserver/8/users
Anyone got suggestions on how to get AD authentication working with XCP-ng Center again? Or add users manaully?

SOLUTION:
What I found after following the steps in the in the XenServer page above is that if I disable AD Authentication then re-enable it then it will work.

To Disable AD Authentication:
xe pool-disable-external-auth

Enable AD Authentication:
xe pool-enable-external-auth auth-type=AD service-name=full-qualified-domain config:user=username config:pass=password

Without the Users tab in XCP-ng Center, CLI command is needed to add or remove users. Refer to the XenServer page above.

xe subject-add subject-name=entity_name

@michael.manley The "Join Domain" option in the Users tab.
Keeping this will be very useful.

@crismarcul Yes, I would also like this option. It is essential.

@gduperrey Is this alternate kernel fix for the fans already released with the November patches for XCP-ng 8.2?
https://xcp-ng.org/blog/2024/11/15/november-2024-security-and-maintenance-update-for-xcp-ng-8-2-lts/

🔧 Update for alternate kernel

Backport of a fix to correct cooling fan rotation speed on some Lenovo servers.

@RIX_IT
I've been informed by XenServer trial support that Lenovo has filed the ticket LEN-605 for this issue, it's probably a private issue tracker though.
They'll let me know once it is fixed.

@RIX_IT Thank you for the tips.

Just for the record, I downgraded the SR645 v3 to UEFI v1.25 KAE106Y and the fans are now spinning at 9000RPM and the fan speed adjusts accordingly depending on the CPU load so I think this is the correct behaviour.

But once upgrade to version UEFI 2.10 KAE112N for the SR645 v3, the fan spins up to 20000RPM with unbearable sound. This also occurs with the latest firmware 4.20 KAE120J.

I opened a ticket with XenServer 8 Trial Edition bugs portal and they finally replied with "This issue is on our radar. We're currently developing a solution. To avoid duplicates, we'll archive this ticket for now"
Not sure when or how it will be fixed though.

@rfx77
I opened a support ticket with Lenovo but still no luck since XenServer 8 is a Vendor Certified OS and not a Lenovo Supported OS.

Vendor Certified: The server has met the OS Partner Certified/Logo program requirements, however, hardware device driver updates may not be available beyond the inbox OS device drivers. As a result support is limited and customers should strongly consider this when determining which OS version to install. The OS vendor provides OS support with inbox drivers only. Lenovo only provides hardware level support, and will work with hardware partners and OS vendors in a best-effort capacity to close any compatibility issues customers may experience with their installation. Lenovo will work with the OS provider to submit hardware compatibility (HCL) test suite results so that the supported solution can be posted to the respective OS providers HCL site.

The SR645 v3 has different UEFI firmware versions to the SR635 v3, it looks like v1.25 for SR645 v3 is equivilent to v1.43 for SR635 v3

==================================================
Version 1.25, Build ID KAE106Y [Critical]
Release date: [May/ 2023]
Release Ref: Genoa Wave2 EAR602 [AMD 2S V3]
==================================================

Support Systems: 
  Lenovo ThinkSystem SR645v3 Server, Machine Types 7D9C/7D9D
  Lenovo ThinkSystem SR665v3 Server, Machine Types 7D9A/7D9B
  
This UEFI supports AMD processor:
  AMD EPYC 9004 Series processor (formerly codenamed "Genoa"), AGESA GenoaPI-SP5_1.0.0.3

1.0 Prerequisites and dependencies
  None
 
2.0 Fixes
  Fixed the issue that configuring OperatingModes.ChooseOperatingMode to "Maximum Performance" from OOB did not match the same configuration in UEFI F1 Setup page.
  Addressed AMD's recent Genoa processor errata that in rare scenarios can result in #UD, #PF, or other unexpected system behavior.
 
3.0 Enhancements
 None

4.0 Limitations 
  None


==================================================
Version 1.43, Build ID KAE110O [Critical]
Release date: [May/ 2023]
Release Ref: Genoa Wave2 EAR602 [AMD 1S V3]
==================================================

Support Systems: 
  Lenovo ThinkSystem SR635v3 Server, Machine Types 7D9G/7D9H
  Lenovo ThinkSystem SR655v3 Server, Machine Types 7D9E/7D9F

This UEFI supports AMD processor:
    AMD EPYC 9004 Series processor (formerly codenamed "Genoa"), AGESA GenoaPI-SP5_1.0.0.4
  
1.0 Prerequisites and dependencies
  None

2.0 Fixes
   Fixed the issue that configuring OperatingModes.ChooseOperatingMode to "Maximum Performance" from OOB did not match the same configuration in UEFI F1 Setup page.
   Addressed AMD's recent Genoa processor errata that in rare scenarios can result in #UD, #PF, or other unexpected system behavior.
  
3.0 Enhancements
   None
	
4.0 Limitations 
  None

What I want to know though is where to download the older version of the UEFI firmware? I can only see the latest version on the Lenovo website.

@rfx77
That's what I thought of too and tried booting into the Xenserver 8 iso XenServer8_2024-06-03.iso.
Even booting with the ISO installer will cause the fans to spin up abnormally fast, up to 20,000RPM.