RLSA-2026:96234: Important: nodejs:22 security, bug fix, and enhancement update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)
undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)
undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)
nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
Bug Fix(es) and Enhancement(s):
nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-302833)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/nodejs-nodemonto a version that resolves this vulnerability.Fixed in 0:3.1.14-3.module+el9.8.0+40281+14cc6568 - Upgrade
Upgrade
rocky-linux/nodejs-packagingto a version that resolves this vulnerability.Fixed in 0:2021.06-6.module+el9.7.0+40165+d075e3f2 - Upgrade
Upgrade
rocky-linux/nodejs-packagingto a version that resolves this vulnerability.Fixed in 0:2021.06-6.module+el9.7.0+40052+e32ea525 - Upgrade
Upgrade
rocky-linux/nodejs-packagingto a version that resolves this vulnerability.Fixed in 0:2021.06-6.module+el9.7.0+40153+4d595597 - Upgrade
Upgrade
rocky-linux/nodejs-packagingto a version that resolves this vulnerability.Fixed in 0:2021.06-6.module+el9.8.0+40164+8921ab53
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Does exploitation require authentication or user interaction?
The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What impact is reflected in the supplied severity vector?
The vector indicates high availability impact and no stated confidentiality or integrity impact. This is consistent with the listed denial-of-service issues.
Which Node.js functionality should be prioritized for exposure review?
Prioritize uses of brace-expansion and undici, along with applications that make TLS connections, validate certificates or hostnames, or use dns.resolve. The update also addresses TLS option handling, TLS renegotiation, and NUL-character hostname handling.
Is a specific fixed package version provided?
No explicit fixed package version is included in the supplied data. The advisory states that Node.js 22 is rebased to the latest Node.js 22 release for rhel-9.8.z.