Nodejs: Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to… (CVE-2026-63073)

This vulnerability in Node.js arises from improper validation of OpenSSL CMP responses, where an unexpected response sender distinguished name is used directly as a format string. This can lead to uncontrolled format string vulnerabilities (CWE-134), potentially allowing an attacker to execute arbitrary code or cause denial of service. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Multiple specific Node.js versions, including Ubuntu package variants, are affected. A patch is available, though no direct patch links are provided in the data. No active exploitation has been reported.

The vulnerability allows remote attackers to exploit the format string issue in OpenSSL CMP response validation within Node.js, potentially leading to full compromise of confidentiality, integrity, and availability of affected systems. Given the CVSS score of 9.8, the impact is critical if exploited. However, there are no known exploits in the wild currently.

A patch is available for this vulnerability and should be applied promptly to affected Node.js versions. Since the vendor advisory or patch links are not provided, users should consult official Node.js or Ubuntu security advisories to obtain and apply the appropriate updates. No additional mitigation steps are indicated.