Bundled OpenSSL 3.5.5 vulnerable - CVE-2026-31789 and related CVEs fixed in OpenSSL 3.5.6 #63320

Node.js version: v24.15.0
Platform: linux/amd64

Description:
Node.js 24.15.0 bundles OpenSSL 3.5.5, which is affected by several CVEs
including CVE-2026-31789, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389,
CVE-2026-28390, CVE-2026-31790, CVE-2026-2673.

These are fixed in OpenSSL 3.5.6.

File paths flagged by AWS Inspector:

• /usr/local/include/node/openssl/archs/linux-x86_64/asm/include/openssl/opensslv.h
• /usr/local/include/node/openssl/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h
• /usr/local/include/node/openssl/archs/linux-x86_64/no-asm/include/openssl/opensslv.h

Request:
Please update the bundled OpenSSL to 3.5.6 in the next Node.js 24.x patch release.

References:

• https://www.openssl.org/news/secadv/20260514.txt (or relevant OpenSSL advisory)