Reviewed 2026-10-25 against the named CVE headings in the official July release advisory and October release advisory. The 21 named entries map to Node2Shell plus 20 separate repositories. Dependency updates mentioned without a separate CVE heading are not an assertion of coverage for every vulnerability in those upstream dependencies. Earlier CVEs referenced as incomplete fixes are not silently treated as separate new July/October entries.
The table records the existing embedded snapshots, not new thresholds or independently verified deployments. Each pinned snapshot contains the exact preconditions, lifecycle/branch exclusions, sources, caveats and its earlier verification date. The 20 additional Node checkers' audited default-branch CI receipts are in the historical initial-audit table in CHECKER_STATUS.md. Those audited CI revisions are distinct from the older pinned snapshot revisions below; this matrix does not claim a CI run on each snapshot commit. The newer Node2Shell and OCI delivery receipts are in its current merge-commit table. No runtime, website or production deployment was assessed for this matrix.
| CVE / checker | Reported fixes by covered major | Pinned evidence contract and preconditions |
|---|---|---|
| CVE-2026-111497 / Node2Shell | 22: 22.23.4; 24: 24.22.1; 26: 26.12.1 | Methodology |
| CVE-2026-105481 | 22: 22.23.4; 24: 24.22.1; 26: 26.12.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-105482 | 22: 22.23.4; 24: 24.22.1; 26: 26.12.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-105483 | 24: 24.22.1; 26: 26.12.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-106069 | 22: 22.23.4; 24: 24.22.1; 26: 26.12.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-106070 | 26: 26.12.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-106071 | 26: 26.12.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-106072 | 22: 22.23.4; 24: 24.22.1; 26: 26.12.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-106073 | 22: 22.23.4; 24: 24.22.1; 26: 26.12.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-106074 | 22: 22.23.4; 24: 24.22.1; 26: 26.12.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-56846 | 22: 22.23.2; 24: 24.18.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-56847 | 22: 22.23.2; 24: 24.18.1; 26: 26.5.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-56848 | 22: 22.23.2; 24: 24.18.1; 26: 26.5.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-56850 | 22: 22.23.2; 24: 24.18.1; 26: 26.5.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-58039 | 22: 22.23.2; 24: 24.18.1; 26: 26.5.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-58040 | 22: 22.23.2; 24: 24.18.1; 26: 26.5.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-58041 | 24: 24.18.1; 26: 26.5.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-58042 | 22: 22.23.2; 24: 24.18.1; 26: 26.5.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-58043 | 22: 22.23.2; 24: 24.18.1; 26: 26.5.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-58044 | 22: 22.23.2; 24: 24.18.1; 26: 26.5.1 | Snapshot, verified 2026-10-24 |
| CVE-2026-58045 | 22: 22.23.2; 24: 24.18.1; 26: 26.5.1 | Snapshot, verified 2026-10-24 |
A repository for every named CVE establishes implementation mapping, not the whole original scope of issue #4. The Node tools accept explicit versions and bounded inventories with independent operator observations; these do not attest runtime feature use, HTTP/2 server configuration, Permission Model policy, resolver behavior, TLS identity handling, startup-snapshot construction or SEA deployment. A static capability does not prove an advisory precondition, nor does its absence clear an old version.
The runtime/build feature collector and npm declaration context are delivered in PR #22. Collector output avoids app imports, environment variables, hostnames, arguments, credentials and application data. No matching source or inventory record can prove absence. Container metadata support is delivered by optional OCI PR #1. Neither support tool is a mandatory runtime dependency of these standalone tools.
The embedded snapshots preserve important exclusions: not every listed CVE
covers every active major. In particular, do not add a missing major to a
snapshot by extrapolating a universal fix, reuse another advisory's fix table,
or classify custom/prerelease/future builds as verified safe. Local
exploitability remains not_tested, independently of external exploitation
reports and lifecycle upgrade guidance.
Both supporting PRs are merged with passing hosted checks on their actual merge commits. Delivery receipts pin those commits and distinguish build/test evidence from runtime attestation.