RLSA-2026:92376: Important: nodejs:24 security, bug fix, and enhancement update

Q: Which deployed packages are in scope for this advisory?

The advisory identifies rocky-linux/nodejs-packaging and rocky-linux/nodejs-nodemon. It covers Node.js 24 security, bug-fix, and enhancement updates.

Q: Can an unauthenticated remote attacker exploit the issues covered by the advisory?

The advisory’s severity vector indicates network reachability, no required privileges, and no user interaction. It also indicates high attack complexity, so exploitability may depend on the specific affected feature and crafted input.

Q: What types of application behavior should be prioritized when assessing exposure?

Prioritize workloads that parse IPv6 addresses or brace-expansion patterns, decode Brotli content, perform TLS hostname validation, resolve DNS names, use random values, or rely on the Node.js permission model. The advisory also identifies a response desynchronization issue, though its full description is not included in the provided data.

Q: Are the listed issues limited to denial of service?

No. Several listed dependency issues are denial-of-service flaws, but the advisory also includes TLS certificate hostname bypasses, DNS hostname truncation, predictable random values, a permission-model bypass, and a Brotli out-of-bounds write. The advisory is rated high with impacts to confidentiality, integrity, and availability.

Published Oct 30, 2026

Updated

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

5 affected componentsFixes available

rocky-linux/nodejs-nodemon<0:3.1.14-2.module+el8.10.0+40277+b1b3f89e

0:3.1.14-2.module+el8.10.0+40277+b1b3f89e

rocky-linux/nodejs-nodemon<0:3.1.14-2.module+el8.10.0+40278+50b003a3

0:3.1.14-2.module+el8.10.0+40278+50b003a3

rocky-linux/nodejs-packaging<0:2021.06-6.module+el8.10.0+40048+6d99f608

0:2021.06-6.module+el8.10.0+40048+6d99f608

rocky-linux/nodejs-packaging<0:2021.06-6.module+el8.10.0+40171+8fa9c325

0:2021.06-6.module+el8.10.0+40171+8fa9c325

rocky-linux/nodejs-packaging<0:2021.06-6.module+el8.10.0+40172+38f6fdd1

0:2021.06-6.module+el8.10.0+40172+38f6fdd1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/nodejs-nodemon to a version that resolves this vulnerability.
Fixed in 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
Upgrade
Upgrade rocky-linux/nodejs-nodemon to a version that resolves this vulnerability.
Fixed in 0:3.1.14-2.module+el8.10.0+40278+50b003a3
Upgrade
Upgrade rocky-linux/nodejs-packaging to a version that resolves this vulnerability.
Fixed in 0:2021.06-6.module+el8.10.0+40048+6d99f608
Upgrade
Upgrade rocky-linux/nodejs-packaging to a version that resolves this vulnerability.
Fixed in 0:2021.06-6.module+el8.10.0+40171+8fa9c325
Upgrade
Upgrade rocky-linux/nodejs-packaging to a version that resolves this vulnerability.
Fixed in 0:2021.06-6.module+el8.10.0+40172+38f6fdd1

Event History

Oct 30, 2026

Advisory Published

via OSV·12:01 AM

Data Sourced

via OSV·12:01 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployed packages are in scope for this advisory?

The advisory identifies rocky-linux/nodejs-packaging and rocky-linux/nodejs-nodemon. It covers Node.js 24 security, bug-fix, and enhancement updates.

Can an unauthenticated remote attacker exploit the issues covered by the advisory?

The advisory’s severity vector indicates network reachability, no required privileges, and no user interaction. It also indicates high attack complexity, so exploitability may depend on the specific affected feature and crafted input.

What types of application behavior should be prioritized when assessing exposure?

Prioritize workloads that parse IPv6 addresses or brace-expansion patterns, decode Brotli content, perform TLS hostname validation, resolve DNS names, use random values, or rely on the Node.js permission model. The advisory also identifies a response desynchronization issue, though its full description is not included in the provided data.

Are the listed issues limited to denial of service?

No. Several listed dependency issues are denial-of-service flaws, but the advisory also includes TLS certificate hostname bypasses, DNS hostname truncation, predictable random values, a permission-model bypass, and a Brotli out-of-bounds write. The advisory is rated high with impacts to confidentiality, integrity, and availability.

RLSA-2026:92376: Important: nodejs:24 security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployed packages are in scope for this advisory?

Can an unauthenticated remote attacker exploit the issues covered by the advisory?

What types of application behavior should be prioritized when assessing exposure?

Are the listed issues limited to denial of service?

Company

Resources

Contact

Frequently Asked Questions

Which deployed packages are in scope for this advisory?

Can an unauthenticated remote attacker exploit the issues covered by the advisory?

What types of application behavior should be prioritized when assessing exposure?

Are the listed issues limited to denial of service?