RLSA-2026:98060: Important: nodejs26 security, bug fix, and enhancement update
Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.
Security Fix(es):
undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)
Bug Fix(es) and Enhancement(s):
Update Node.js 26 spec file for Rust package integration [rhel-10.3.z] (JIRA:Rocky Linux-256956)
nodejs26: Rebase to the latest Node.js 26 release [rhel-10.3.z] (JIRA:Rocky Linux-262243)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/nodejs26-docsto a version that resolves this vulnerability.Fixed in 1:26.8.2-1.el10_3 - Upgrade
Upgrade
rocky-linux/nodejs26-npmto a version that resolves this vulnerability.Fixed in 1:11.19.1-1.26.8.2.1.el10_3 - Upgrade
Upgrade
rocky-linux/nodejs26-libsto a version that resolves this vulnerability.Fixed in 1:26.8.2-1.el10_3 - Upgrade
Upgrade
rocky-linux/nodejs26-libs-debuginfoto a version that resolves this vulnerability.Fixed in 1:26.8.2-1.el10_3 - Upgrade
Upgrade
rocky-linux/nodejs26-debugsourceto a version that resolves this vulnerability.Fixed in 1:26.8.2-1.el10_3 - Upgrade
Upgrade
rocky-linux/nodejs26-develto a version that resolves this vulnerability.Fixed in 1:26.8.2-1.el10_3 - Upgrade
Upgrade
rocky-linux/nodejs26-debuginfoto a version that resolves this vulnerability.Fixed in 1:26.8.2-1.el10_3 - Upgrade
Upgrade
rocky-linux/nodejs26to a version that resolves this vulnerability.Fixed in 1:26.8.2-1.el10_3 - Upgrade
Upgrade
rocky-linux/nodejs26-full-i18nto a version that resolves this vulnerability.Fixed in 1:26.8.2-1.el10_3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which installed packages are covered by this update?
The update covers nodejs26, nodejs26-devel, nodejs26-libs, nodejs26-npm, nodejs26-docs, and their listed debuginfo and debugsource packages on Rocky Linux.
What security impacts are addressed?
The update fixes an undici authentication bypass involving cross-origin cache poisoning, a TLS certificate validation bypass in BalancedPool caused by dropped connection options, and a denial of service involving an unrequested WebSocket subprotocol.
Does exploitation require prior authentication or user interaction?
The advisory’s overall CVSS vector specifies no privileges required and no user interaction. It also specifies network attack vector and low attack complexity.