ALSA-2026:92376: Important: nodejs:24 security, bug fix, and enhancement update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911) brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277) brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483) nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069) nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482) nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074) nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071) nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481) nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073) nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
Bug Fix(es) and Enhancement(s):
nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
almalinux/nodejsto a version that resolves this vulnerability.Fixed in 1:24.22.1-1.module_el8.10.0+4331+0683c9c1 - Upgrade
Upgrade
almalinux/nodejs-develto a version that resolves this vulnerability.Fixed in 1:24.22.1-1.module_el8.10.0+4331+0683c9c1 - Upgrade
Upgrade
almalinux/nodejs-docsto a version that resolves this vulnerability.Fixed in 1:24.22.1-1.module_el8.10.0+4331+0683c9c1 - Upgrade
Upgrade
almalinux/nodejs-full-i18nto a version that resolves this vulnerability.Fixed in 1:24.22.1-1.module_el8.10.0+4331+0683c9c1 - Upgrade
Upgrade
almalinux/nodejs-libsto a version that resolves this vulnerability.Fixed in 1:24.22.1-1.module_el8.10.0+4331+0683c9c1 - Upgrade
Upgrade
almalinux/nodejs-nodemonto a version that resolves this vulnerability.Fixed in 3.1.14-2.module_el8.10.0+4250+09238ed4 - Upgrade
Upgrade
almalinux/nodejs-packagingto a version that resolves this vulnerability.Fixed in 2021.06-6.module_el8.10.0+4086+70facd4a - Upgrade
Upgrade
almalinux/nodejs-packaging-bundlerto a version that resolves this vulnerability.Fixed in 2021.06-6.module_el8.10.0+4086+70facd4a - Upgrade
Upgrade
almalinux/npmto a version that resolves this vulnerability.Fixed in 1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1 - Upgrade
Upgrade
almalinux/v8-13.6-develto a version that resolves this vulnerability.Fixed in 3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1 - Upgrade
Upgrade
nodejs:24to a version that resolves this vulnerability.Patch RHEL-289763
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which installed packages are covered by this advisory?
The advisory covers AlmaLinux nodejs, nodejs-devel, nodejs-docs, nodejs-full-i18n, nodejs-libs, nodejs-nodemon, nodejs-packaging, and nodejs-packaging-bundler packages.
What types of impact are addressed by the listed fixes?
The listed issues include denial of service through IPv6 or brace-pattern parsing, an out-of-bounds write in the Brotli decoder, TLS certificate hostname-validation bypasses, DNS hostname truncation involving NUL characters, predictable random values, and a permission-model bypass. The description also indicates a response desynchronization issue, but its details are truncated.
Are all listed vulnerabilities in Node.js itself?
No. The advisory lists issues in bundled or related components including ip-address, brace-expansion, and brotli, as well as multiple issues identified as nodejs vulnerabilities.