RLSA-2026:96088: Important: nodejs24 security, bug fix, and enhancement update

Q: Which deployments are in scope for this update?

The advisory applies to the Rocky Linux nodejs24 package. It covers issues in Node.js itself and bundled or associated brace-expansion and undici components.

Q: Can these issues be exploited remotely without authentication?

The advisory is rated with a network attack vector, low attack complexity, no required privileges, and no user interaction. Its listed CVSS impact is availability only, with high availability impact and no listed confidentiality or integrity impact.

Q: What types of security failures are addressed?

The listed fixes include denial-of-service conditions in brace-expansion and undici, TLS certificate validation and hostname-verification bypasses, and an undici cross-origin redirect cache issue that can cause cache poisoning and information disclosure.

Q: Does the advisory provide affected or fixed package versions?

No affected or fixed nodejs24 package version is included in the provided advisory data. Use the referenced Rocky Linux errata record to determine the update version applicable to your system.

Published Nov 10, 2026

Updated

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)

undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)

nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

Bug Fix(es) and Enhancement(s):

nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-295759)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

1 affected componentFixes available

rocky-linux/nodejs24<1:24.22.1-3.el10_2

1:24.22.1-3.el10_2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/nodejs24 to a version that resolves this vulnerability.
Fixed in 1:24.22.1-3.el10_2

Event History

Nov 10, 2026

Advisory Published

via OSV·12:09 PM

Data Sourced

via OSV·12:09 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments are in scope for this update?

The advisory applies to the Rocky Linux nodejs24 package. It covers issues in Node.js itself and bundled or associated brace-expansion and undici components.

Can these issues be exploited remotely without authentication?

The advisory is rated with a network attack vector, low attack complexity, no required privileges, and no user interaction. Its listed CVSS impact is availability only, with high availability impact and no listed confidentiality or integrity impact.

What types of security failures are addressed?

The listed fixes include denial-of-service conditions in brace-expansion and undici, TLS certificate validation and hostname-verification bypasses, and an undici cross-origin redirect cache issue that can cause cache poisoning and information disclosure.

Does the advisory provide affected or fixed package versions?

No affected or fixed nodejs24 package version is included in the provided advisory data. Use the referenced Rocky Linux errata record to determine the update version applicable to your system.

RLSA-2026:96088: Important: nodejs24 security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are in scope for this update?

Can these issues be exploited remotely without authentication?

What types of security failures are addressed?

Does the advisory provide affected or fixed package versions?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are in scope for this update?

Can these issues be exploited remotely without authentication?

What types of security failures are addressed?

Does the advisory provide affected or fixed package versions?