[ALSA-2026:7670] Important: nodejs:24 security update
Type:
security
Severity:
important
Release date:
2026-04-15
Description:
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Nodejs denial of service (CVE-2026-21637) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581) * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715) * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716) * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711) * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713) * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714) * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 nodejs-devel-24.14.1-2.module_el8.10.0+4160+4819ac42.aarch64.rpm 0e4333315579297d50895949e4ce663a3bf71ab351ead99479ef15718a4097e9
aarch64 nodejs-full-i18n-24.14.1-2.module_el8.10.0+4160+4819ac42.aarch64.rpm 1e44aab7b0f1502524980f3c6b611c01c831eed2662b1973f2877262be43d8af
aarch64 nodejs-libs-24.14.1-2.module_el8.10.0+4160+4819ac42.aarch64.rpm 7725e8346902568d942c7a9bf3cefd310180245040e2632c6b0bde23f7b4451b
aarch64 v8-13.6-devel-13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42.aarch64.rpm aac5e73c322aefa82d2e3db01d96e503f70ba6802347cac713185b9519df95f1
aarch64 nodejs-24.14.1-2.module_el8.10.0+4160+4819ac42.aarch64.rpm c8d3613e127932835c950a8f07abf9f2b3d185803b3dc6097af3a00c927086c7
noarch npm-11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42.noarch.rpm 149b7e5f38874abbc9d1a1f050adfb1b83230912911b200f8251cae7894a2d5d
noarch nodejs-packaging-2021.06-6.module_el8.10.0+4086+70facd4a.noarch.rpm 318c493f93f2190506361306b5759e5e65eee18e3a8d85b195c800d8b7064bc0
noarch nodejs-nodemon-3.0.3-1.module_el8.10.0+4061+f8ceeab9.noarch.rpm 9a38ec0d35f9d0671cb0343c1270c1a85bf1b2250b40fe3facedbd919eee2b91
noarch nodejs-docs-24.14.1-2.module_el8.10.0+4160+4819ac42.noarch.rpm abe67a31cd2999167bc5472e65525c87a37ca44518e006aba6117a1b40029f80
noarch nodejs-packaging-bundler-2021.06-6.module_el8.10.0+4086+70facd4a.noarch.rpm f4b4a25dc07327deb51619715aae6bd35d22e29ccfc97141c0b61de3a1995eee
ppc64le nodejs-24.14.1-2.module_el8.10.0+4160+4819ac42.ppc64le.rpm 2bdfac6b7a70df130f2b7892d9f2c5757ad18f2c15cf57eb2a9041786c34928e
ppc64le v8-13.6-devel-13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42.ppc64le.rpm b88c0cd691f87c45ccf167e287899ccb1499b1d51c1d87deb0ec4b35a60f3cb6
ppc64le nodejs-devel-24.14.1-2.module_el8.10.0+4160+4819ac42.ppc64le.rpm ca18a7ed245a1cf1c6c959854ae63116abf6559cc14dc263c53da2848c99c380
ppc64le nodejs-full-i18n-24.14.1-2.module_el8.10.0+4160+4819ac42.ppc64le.rpm e09f9472cd1f0ae262586527a55ca210ddbbbc97f05956642c97ef88cd497dc7
ppc64le nodejs-libs-24.14.1-2.module_el8.10.0+4160+4819ac42.ppc64le.rpm e2522cda2227fd9d58c1365b2f882ba1e31655e4ddfd8299b584cc5b211217ab
s390x nodejs-devel-24.14.1-2.module_el8.10.0+4160+4819ac42.s390x.rpm 0345deed16df0834a8b9e11f4fee9012ea24d3704a2f95628bebeb36d485858b
s390x v8-13.6-devel-13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42.s390x.rpm 2876a7e157c907a54b11c117b41148d73c122d6edad30ee9bff40932de97fe46
s390x nodejs-libs-24.14.1-2.module_el8.10.0+4160+4819ac42.s390x.rpm a26c381cf7049229810f2d3878e491a25d450ca174ff41a54c12545fc69107b8
s390x nodejs-full-i18n-24.14.1-2.module_el8.10.0+4160+4819ac42.s390x.rpm f6a728cf12ebce6bf2f7ee530f3793acfc96efc36126305c1216655643878bfa
s390x nodejs-24.14.1-2.module_el8.10.0+4160+4819ac42.s390x.rpm fc61e99d3e925a0d04cfa6d7df93b9e5bb5ccde1947142a799dd0385889ee410
x86_64 nodejs-devel-24.14.1-2.module_el8.10.0+4160+4819ac42.x86_64.rpm 24b9ab33b3a3f1a210c6ccb557c879aa1974c2e910ad46d2f8ec91b71b329300
x86_64 nodejs-full-i18n-24.14.1-2.module_el8.10.0+4160+4819ac42.x86_64.rpm 5da87c13eaa5f79f5d06b27c8a80c913f6d99bf3e426642e48a700322b67b2b0
x86_64 v8-13.6-devel-13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42.x86_64.rpm b0582a291e3bba2f7184e68d23e091609f2edefd429261ff9e51f552243f9ec0
x86_64 nodejs-24.14.1-2.module_el8.10.0+4160+4819ac42.x86_64.rpm b7f4ab47219b50f8f2719d39db16ce85a23145b6358948d5e0fbdca6ff568e6a
x86_64 nodejs-libs-24.14.1-2.module_el8.10.0+4160+4819ac42.x86_64.rpm e43394f191492298d2d37f4682f9c97d48daec44253fbd0ed98808d1e445ffeb
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.