RLSA-2026:98102: Important: nodejs:24 security update

Q: Which attack paths are represented in this update?

The update addresses denial-of-service issues in brace-expansion, undici, and SQLite; a certificate-validation bypass in undici; and arbitrary code execution issues in SQLite involving crafted session changesets or corrupted FTS5 indexes.

Q: What input or conditions are associated with exploitation?

The described issues involve nested or crafted brace patterns, excessive content encodings, TLS renegotiation with a mismatched certificate, dropped TLS options in an Agent, and crafted or corrupted SQLite data structures. The provided data does not state which applications expose these inputs or whether they are enabled by default.

Q: Which Rocky Linux software packages are identified by this advisory?

The advisory identifies rocky-linux/nodejs-packaging and rocky-linux/nodejs-nodemon. No fixed package versions are provided in the supplied data.

Q: Can this advisory be triaged as only a denial-of-service issue?

No. In addition to denial-of-service flaws, the advisory includes an undici certificate-validation bypass and SQLite issues described as allowing arbitrary code execution.

Published Nov 11, 2026

Updated

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)

undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)

sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)

sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

5 affected componentsFixes available

rocky-linux/nodejs-nodemon<0:3.1.14-2.module+el8.10.0+40277+b1b3f89e

0:3.1.14-2.module+el8.10.0+40277+b1b3f89e

rocky-linux/nodejs-nodemon<0:3.1.14-2.module+el8.10.0+40278+50b003a3

0:3.1.14-2.module+el8.10.0+40278+50b003a3

rocky-linux/nodejs-packaging<0:2021.06-6.module+el8.10.0+40048+6d99f608

0:2021.06-6.module+el8.10.0+40048+6d99f608

rocky-linux/nodejs-packaging<0:2021.06-6.module+el8.10.0+40171+8fa9c325

0:2021.06-6.module+el8.10.0+40171+8fa9c325

rocky-linux/nodejs-packaging<0:2021.06-6.module+el8.10.0+40172+38f6fdd1

0:2021.06-6.module+el8.10.0+40172+38f6fdd1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/nodejs-nodemon to a version that resolves this vulnerability.
Fixed in 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
Upgrade
Upgrade rocky-linux/nodejs-nodemon to a version that resolves this vulnerability.
Fixed in 0:3.1.14-2.module+el8.10.0+40278+50b003a3
Upgrade
Upgrade rocky-linux/nodejs-packaging to a version that resolves this vulnerability.
Fixed in 0:2021.06-6.module+el8.10.0+40048+6d99f608
Upgrade
Upgrade rocky-linux/nodejs-packaging to a version that resolves this vulnerability.
Fixed in 0:2021.06-6.module+el8.10.0+40171+8fa9c325
Upgrade
Upgrade rocky-linux/nodejs-packaging to a version that resolves this vulnerability.
Fixed in 0:2021.06-6.module+el8.10.0+40172+38f6fdd1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:01 PM

Data Sourced

via OSV·12:01 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which attack paths are represented in this update?

The update addresses denial-of-service issues in brace-expansion, undici, and SQLite; a certificate-validation bypass in undici; and arbitrary code execution issues in SQLite involving crafted session changesets or corrupted FTS5 indexes.

What input or conditions are associated with exploitation?

The described issues involve nested or crafted brace patterns, excessive content encodings, TLS renegotiation with a mismatched certificate, dropped TLS options in an Agent, and crafted or corrupted SQLite data structures. The provided data does not state which applications expose these inputs or whether they are enabled by default.

Which Rocky Linux software packages are identified by this advisory?

The advisory identifies rocky-linux/nodejs-packaging and rocky-linux/nodejs-nodemon. No fixed package versions are provided in the supplied data.

Can this advisory be triaged as only a denial-of-service issue?

No. In addition to denial-of-service flaws, the advisory includes an undici certificate-validation bypass and SQLite issues described as allowing arbitrary code execution.

RLSA-2026:98102: Important: nodejs:24 security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which attack paths are represented in this update?

What input or conditions are associated with exploitation?

Which Rocky Linux software packages are identified by this advisory?

Can this advisory be triaged as only a denial-of-service issue?

Company

Resources

Contact

Frequently Asked Questions

Which attack paths are represented in this update?

What input or conditions are associated with exploitation?

Which Rocky Linux software packages are identified by this advisory?

Can this advisory be triaged as only a denial-of-service issue?