RHSA-2026:98060: Important: nodejs26 security, bug fix, and enhancement update

Q: Which components and deployments are most relevant to the authentication-bypass issue?

The issue is in undici and concerns cross-origin cache poisoning caused by missing origin isolation. Deployments that use undici in scenarios involving requests or cached responses across different origins are the relevant exposure area.

Q: What condition is associated with the TLS certificate validation bypass?

The TLS validation issue affects undici's BalancedPool when connect options are dropped. The provided advisory does not state which application configurations invoke BalancedPool or whether this occurs in default configurations.

Q: What is the impact of the WebSocket-related flaw?

The undici WebSocket issue can cause denial of service through an unrequested WebSocket subprotocol. The advisory does not provide further exploitation prerequisites or mitigations.

Q: Which Red Hat packages are covered by this update?

The update covers nodejs26 and related packages: nodejs26-devel, nodejs26-full-i18n, nodejs26-libs, nodejs26-docs, nodejs26-debuginfo, nodejs26-debugsource, and nodejs26-libs-debuginfo.

Published Nov 11, 2026

Updated

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.Security Fix(es): undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152) undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961) undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) Bug Fix(es) and Enhancement(s): Update Node.js 26 spec file for Rust package integration [rhel-10.3.z] (JIRA:RHEL-256956) nodejs26: Rebase to the latest Node.js 26 release [rhel-10.3.z] (JIRA:RHEL-262243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

30 affected componentsFixes available

redhat/nodejs26<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-debuginfo<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-debugsource<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-devel<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-docs<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-full-i18n<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-libs<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-libs-debuginfo<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-npm<11.19.1-1.26.8.2.1.el10_3

11.19.1-1.26.8.2.1.el10_3

redhat/nodejs26-debuginfo<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-debugsource<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-devel<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-full-i18n<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-libs<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-libs-debuginfo<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-debuginfo<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-debugsource<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-devel<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-full-i18n<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-libs<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26-libs-debuginfo<26.8.2-1.el10_3

26.8.2-1.el10_3

redhat/nodejs26<26.8.2-1.el10_3.aa

26.8.2-1.el10_3.aa

redhat/nodejs26-debuginfo<26.8.2-1.el10_3.aa

26.8.2-1.el10_3.aa

redhat/nodejs26-debugsource<26.8.2-1.el10_3.aa

26.8.2-1.el10_3.aa

redhat/nodejs26-devel<26.8.2-1.el10_3.aa

26.8.2-1.el10_3.aa

redhat/nodejs26-full-i18n<26.8.2-1.el10_3.aa

26.8.2-1.el10_3.aa

redhat/nodejs26-libs<26.8.2-1.el10_3.aa

26.8.2-1.el10_3.aa

redhat/nodejs26-libs-debuginfo<26.8.2-1.el10_3.aa

26.8.2-1.el10_3.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/nodejs26 to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3
Upgrade
Upgrade redhat/nodejs26-debuginfo to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3
Upgrade
Upgrade redhat/nodejs26-debugsource to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3
Upgrade
Upgrade redhat/nodejs26-devel to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3
Upgrade
Upgrade redhat/nodejs26-docs to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3
Upgrade
Upgrade redhat/nodejs26-full-i18n to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3
Upgrade
Upgrade redhat/nodejs26-libs to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3
Upgrade
Upgrade redhat/nodejs26-libs-debuginfo to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3
Upgrade
Upgrade redhat/nodejs26-npm to a version that resolves this vulnerability.
Fixed in 11.19.1-1.26.8.2.1.el10_3
Upgrade
Upgrade redhat/nodejs26 to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3.aa
Upgrade
Upgrade redhat/nodejs26-debuginfo to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3.aa
Upgrade
Upgrade redhat/nodejs26-debugsource to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3.aa
Upgrade
Upgrade redhat/nodejs26-devel to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3.aa
Upgrade
Upgrade redhat/nodejs26-full-i18n to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3.aa
Upgrade
Upgrade redhat/nodejs26-libs to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3.aa
Upgrade
Upgrade redhat/nodejs26-libs-debuginfo to a version that resolves this vulnerability.
Fixed in 26.8.2-1.el10_3.aa
Upgrade
Upgrade nodejs26 to a version that resolves this vulnerability.
Patch RHEL-262243

Event History

Nov 11, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

Which components and deployments are most relevant to the authentication-bypass issue?

The issue is in undici and concerns cross-origin cache poisoning caused by missing origin isolation. Deployments that use undici in scenarios involving requests or cached responses across different origins are the relevant exposure area.

What condition is associated with the TLS certificate validation bypass?

The TLS validation issue affects undici's BalancedPool when connect options are dropped. The provided advisory does not state which application configurations invoke BalancedPool or whether this occurs in default configurations.

What is the impact of the WebSocket-related flaw?

The undici WebSocket issue can cause denial of service through an unrequested WebSocket subprotocol. The advisory does not provide further exploitation prerequisites or mitigations.

Which Red Hat packages are covered by this update?

The update covers nodejs26 and related packages: nodejs26-devel, nodejs26-full-i18n, nodejs26-libs, nodejs26-docs, nodejs26-debuginfo, nodejs26-debugsource, and nodejs26-libs-debuginfo.

RHSA-2026:98060: Important: nodejs26 security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which components and deployments are most relevant to the authentication-bypass issue?

What condition is associated with the TLS certificate validation bypass?

What is the impact of the WebSocket-related flaw?

Which Red Hat packages are covered by this update?

Company

Resources

Contact

Frequently Asked Questions

Which components and deployments are most relevant to the authentication-bypass issue?

What condition is associated with the TLS certificate validation bypass?

What is the impact of the WebSocket-related flaw?

Which Red Hat packages are covered by this update?