Commit b615ce858fd for nodejs

commit b615ce858fd92c35e1a7111af16b78e9bcf29733
Author: inoway46 <inoueyuya416@gmail.com>
Date:   Sun Oct 25 01:37:55 2026 +0900

    doc: list CVE-2026-106072 in v24 changelog

    The non-canonical IP address fix also addresses CVE-2026-106072.
    Record both CVE IDs in the v24.22.1 notable changes.

    Refs: https://github.com/nodejs/node/issues/66981
    Assisted-by: a closed-source coding agent
    Signed-off-by: inoway46 <inoueyuya416@gmail.com>
    PR-URL: https://github.com/nodejs/node/pull/66984
    Fixes: https://github.com/nodejs/node/issues/66981
    Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

diff --git a/doc/changelogs/CHANGELOG_V24.md b/doc/changelogs/CHANGELOG_V24.md
index a52ea197f94..c29c8c997dc 100644
--- a/doc/changelogs/CHANGELOG_V24.md
+++ b/doc/changelogs/CHANGELOG_V24.md
@@ -100,7 +100,7 @@ This is a security release.
 * (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
 * (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
 * (CVE-2026-105483) tls: fix ip normalization regression (James M Snell)
-* (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
+* (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina)
 * (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
 * (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
 * (CVE-2026-111497) src: expose `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (Antoine du Hamel)