RLSA-2026:96226: Important: nodejs:24 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)
brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)
undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)
undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)
minimatch: minimatch: Denial of Service via crafted glob pattern expansion (CVE-2026-118764)
sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)
sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)
sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/nodejs-packagingto a version that resolves this vulnerability.Fixed in 0:2021.06-6.module+el9.7.0+40165+d075e3f2 - Upgrade
Upgrade
rocky-linux/nodejs-packagingto a version that resolves this vulnerability.Fixed in 0:2021.06-6.module+el9.7.0+40052+e32ea525 - Upgrade
Upgrade
rocky-linux/nodejs-packagingto a version that resolves this vulnerability.Fixed in 0:2021.06-6.module+el9.7.0+40153+4d595597 - Upgrade
Upgrade
rocky-linux/nodejs-packagingto a version that resolves this vulnerability.Fixed in 0:2021.06-6.module+el9.8.0+40164+8921ab53
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What level of access and interaction do the listed issues require?
The advisory rates the attack vector as local, with low attack complexity and no privileges required. User interaction is required according to the supplied severity vector.
What could a successful attack affect?
The severity vector indicates high impact to confidentiality, integrity, and availability. The listed fixes include denial-of-service issues, a certificate-validation bypass, and SQLite issues described as allowing arbitrary code execution.
Which components are covered by the update?
The security fixes named in the advisory affect undici, brace-expansion, minimatch, and SQLite components in the Node.js package update.