[ALSA-2026:48034] Important: nodejs24 security update
Type:
security
Severity:
important
Release date:
2026-07-30
Description:
Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 nodejs24-24.18.0-3.el10_2.aarch64.rpm 376cc4807f2207404fcfd9273af15c8094ac4c4ac04616820b61ea7f532aa74b
aarch64 nodejs24-full-i18n-24.18.0-3.el10_2.aarch64.rpm bb07bb11ff61d830c8ed6af44b2fb146238014a0921639797a4642aa55526d84
aarch64 nodejs24-libs-24.18.0-3.el10_2.aarch64.rpm e4a0231960c2ea96881f4a06986fcdfc5b9dc14e3d2ff95904cfd314176270f6
aarch64 nodejs24-devel-24.18.0-3.el10_2.aarch64.rpm e96797f8f5ce7e4ab0a03eb87833691e51e961873fd368fcb7482a41449114c8
noarch nodejs24-docs-24.18.0-3.el10_2.noarch.rpm 89066bd3e4a424f6060b375e6c02c05394b0753a9457c3f2bea0b8ca3a7ef097
noarch nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm a0d67f6698a66c5d36c8a723a620bfc3e7512941af628d160a75f70e47142745
ppc64le nodejs24-libs-24.18.0-3.el10_2.ppc64le.rpm 46a7c0d1c47800febfc78d5adee695a6ecb579840ad84243918e97b3c4be9b79
ppc64le nodejs24-full-i18n-24.18.0-3.el10_2.ppc64le.rpm 6b7cb5833d0929f3f2642b3e2835a32dc2cae5cfdf7bad1b98dacf4c2f1cb9f2
ppc64le nodejs24-24.18.0-3.el10_2.ppc64le.rpm 83af59b823f132af71636949a754ffd70036f9c5f3dc5e45d72f9929a9804b96
ppc64le nodejs24-devel-24.18.0-3.el10_2.ppc64le.rpm d4fa388133c7ab56adfdbda0f109fdc9e3a99564b1e6605361af57acb60ba787
s390x nodejs24-libs-24.18.0-3.el10_2.s390x.rpm 75b1148b3271c2c1c2b99d9772f57d2644d08f58a3cd2d05b98319a302126b10
s390x nodejs24-full-i18n-24.18.0-3.el10_2.s390x.rpm b991dc453b6c08c82225a5a28339f39b3388ef56ca265c84cd037332f7dac5be
s390x nodejs24-devel-24.18.0-3.el10_2.s390x.rpm ce9e783026e4bca3ec688ac8ff12f3d8751f106f2464d437be74c5165b0f1dc5
s390x nodejs24-24.18.0-3.el10_2.s390x.rpm d9651575ab18527d75709901d25406a5803b16a5276bfcf6692a11dff82ee82a
x86_64 nodejs24-devel-24.18.0-3.el10_2.x86_64.rpm 283dd9c7663558278b2463680bab4fff82a913418f83ba3967cc2cb496713f83
x86_64 nodejs24-24.18.0-3.el10_2.x86_64.rpm 807b715a991353b9a867694e25ec3aa2e028d4dab148393505b98444327dfdc0
x86_64 nodejs24-full-i18n-24.18.0-3.el10_2.x86_64.rpm dd1e7a800d4c964db6b329e68174eda0300a3d2b4fd05a380df1893c5c776fee
x86_64 nodejs24-libs-24.18.0-3.el10_2.x86_64.rpm e7536800c3441786c05e1a892fadd38c240fc63594964892e3129c54adaaaae4
x86_64_v2 nodejs24-full-i18n-24.18.0-3.el10_2.x86_64_v2.rpm 70ab798a204dae3e8ac5ecedbd3b4b659d4566cb57d92c0d9022ebf7e7a3af97
x86_64_v2 nodejs24-devel-24.18.0-3.el10_2.x86_64_v2.rpm c81e848dad8b6863dbedbfba91123ef63b4cbeedbfaecb8b42cc625d251191ee
x86_64_v2 nodejs24-libs-24.18.0-3.el10_2.x86_64_v2.rpm d167e8b6b601e32fde15a69674e118a2ea4da06fbbbedfef74fb9655ae1ed774
x86_64_v2 nodejs24-24.18.0-3.el10_2.x86_64_v2.rpm dcbf23b84d7a0cbf8c5618e3dc399ce5ebf450f1e94b6ce673f27e0f65f8b071
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.