RHSA-2026:61377: Important: nodejs24 security, bug fix, and enhancement update
Important: nodejs24 security, bug fix, and enhancement update
Other sources
Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.Security Fix(es): nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) Bug Fix(es) and Enhancement(s): nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-220543) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nodejs24to a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2 - Upgrade
Upgrade
redhat/nodejs24-debuginfoto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2 - Upgrade
Upgrade
redhat/nodejs24-debugsourceto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2 - Upgrade
Upgrade
redhat/nodejs24-develto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2 - Upgrade
Upgrade
redhat/nodejs24-docsto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2 - Upgrade
Upgrade
redhat/nodejs24-full-i18nto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2 - Upgrade
Upgrade
redhat/nodejs24-libsto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2 - Upgrade
Upgrade
redhat/nodejs24-libs-debuginfoto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2 - Upgrade
Upgrade
redhat/nodejs24-npmto a version that resolves this vulnerability.Fixed in 11.17.0-1.24.19.0.1.el10_2 - Upgrade
Upgrade
redhat/nodejs24to a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2.aa - Upgrade
Upgrade
redhat/nodejs24-debuginfoto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2.aa - Upgrade
Upgrade
redhat/nodejs24-debugsourceto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2.aa - Upgrade
Upgrade
redhat/nodejs24-develto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2.aa - Upgrade
Upgrade
redhat/nodejs24-full-i18nto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2.aa - Upgrade
Upgrade
redhat/nodejs24-libsto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2.aa - Upgrade
Upgrade
redhat/nodejs24-libs-debuginfoto a version that resolves this vulnerability.Fixed in 24.19.0-1.el10_2.aa - Upgrade
Upgrade
nodejs24to a version that resolves this vulnerability.Fixed in rhel-10.2.zPatch JIRA:RHEL-220543 - Compensating control
To reduce exposure from the described HTTP/2 issues (CVE-2026-56848 heap-use-after-free and CVE-2026-56846 remote memory exhaustion via retained header blocks), consider blocking or restricting inbound HTTP/2 traffic (e.g., via load balancer/WAF/firewall rules) until the update is applied.
Event History
Frequently Asked Questions
Which Node.js components should be included when assessing exposure?
The advisory lists nodejs24 and its related debuginfo, debugsource, devel, full-i18n, and libs packages. Systems running the Node.js runtime should be prioritized because the reported issues affect permission enforcement and HTTP/2 handling.
What attack conditions are identified for the HTTP/2 issues?
One issue involves remote memory exhaustion through retained HTTP/2 header blocks, and another is a heap-use-after-free in HTTP/2 handling that can cause denial of service. The advisory does not state any authentication requirement or specific request pattern beyond HTTP/2 handling.
Are these issues limited to a single type of impact?
No. The listed fixes address unauthorized filesystem access caused by a Permission Model enforcement flaw, remote memory exhaustion, and denial of service from a heap-use-after-free condition.