SECURITY ADVISORY · DEVLINK-SA-2026-002
OpenSSL update in the
Node.js runtime.
ChargeLink Admin 1.1.0 bundles Node.js 24.22.1 with OpenSSL 3.5.9, which fixes a low-severity OpenSSL issue in certificate parsing. A fixed DEVlink Licence Server is in preparation.
How to update ↓CSAF 2.0 (JSON) ↗At a glance.
- Severity
- Low
- CVE
- CVE-2026-35189
- Actively exploited
- No known exploitation
- Published
- Affected
- ChargeLink Admin 1.0.0 to 1.0.3 · DEVlink Licence Server 1.0.0 to 1.0.2
- Fixed
- ChargeLink Admin 1.1.0 · Licence Server: fix in preparation (1.0.3)
AFFECTED PRODUCTS
Who needs to update.
| Product | Affected versions | Fixed version |
|---|---|---|
| ChargeLink Admin (Windows installer) | 1.0.0 to 1.0.3 | 1.1.0 |
| DEVlink Licence Server (Windows installer) | 1.0.0 to 1.0.2 | Fix in preparation 1.0.3; this advisory will be revised when it ships |
DESCRIPTION & IMPACT
What happened.
What it means.
Description
ChargeLink Admin and the DEVlink Licence Server run on a bundled Node.js runtime. Admin 1.0.0 and Licence Server 1.0.0 bundle Node.js 24.19.0 (OpenSSL 3.5.7); Admin 1.0.1 to 1.0.3 and Licence Server 1.0.1 to 1.0.2 bundle Node.js 24.21.0 (OpenSSL 3.5.8).
OpenSSL 3.5.9 fixes CVE-2026-35189, a low-severity issue in parsing the CRL distribution points of an X.509 certificate. Since ChargeLink Admin 1.0.2, Admin's separate openssl.exe (used to create and display certificates) was already 3.5.9; this advisory covers the OpenSSL inside Node.js.
Impact
Availability only. Reaching the issue needs an authenticated engineer or administrator who imports a crafted certificate, or a crafted certificate chain from an update source the administrator configured. The ChargeLink engine is not affected.
REMEDIATION
Update to
ChargeLink Admin 1.1.0.
It bundles Node.js 24.22.1, the Node.js security release with OpenSSL 3.5.9, and openssl.exe 3.5.9. The installer and the program are signed by DEVlink AB. 1.1.0 is a free update for every affected customer: it is free of charge and runs under every licence that covers 1.0.0 to 1.0.3, including perpetual licences without maintenance.
ChargeLinkAdminSetup-1.1.0.exe SHA-256:169F0DDB7427793F83E3A64D0E9ABEFF27230259C0E4E3DA8202B8E155D9048B- DEVlink Licence Server: a fixed release (1.0.3, with Node.js 24.22.1) is in preparation. This advisory will be revised when it ships.
- Until you update: import certificates only from trusted sources, and configure only update sources you trust.
- Check the installed version in Windows Settings → Apps → Installed apps. After the update, ChargeLink Admin shows version 1.1.0. Windows shows DEVlink AB as the verified publisher of the installer.
CONTACT
Questions about this advisory?
Report security issues to security@devlink.se. Revision 1, 29 October 2026.