[ALSA-2026:92376] Important: nodejs:24 security, bug fix, and enhancement update
Type:
security
Severity:
important
Release date:
2026-10-29
Description:
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911) * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483) * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069) * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482) * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074) * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071) * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481) * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073) * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072) Bug Fix(es) and Enhancement(s): * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 nodejs-libs-24.22.1-1.module_el8.10.0+4331+0683c9c1.aarch64.rpm 827e06246254fa7a16e7c544f106586a727a3b082c556613037698aa5ab8b2c5
aarch64 nodejs-devel-24.22.1-1.module_el8.10.0+4331+0683c9c1.aarch64.rpm 95068a63cdc4e9cc8d3fda8789913fe13e406f2b6cf8eb1643e4d8b523569e56
aarch64 nodejs-24.22.1-1.module_el8.10.0+4331+0683c9c1.aarch64.rpm b4de3eba1888a1fff7eb065e98bc2a8585a3799e62c46cb6e8793efac09dbcc4
aarch64 v8-13.6-devel-13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1.aarch64.rpm bb219dcae73b78b458d977f4d09470eb4b029a0e7a13e5977833c66e235dd781
aarch64 nodejs-full-i18n-24.22.1-1.module_el8.10.0+4331+0683c9c1.aarch64.rpm dadbe610ffffbb2ef309556fce84b718776d3fa6ead4131fa25ba98f95211c55
noarch nodejs-docs-24.22.1-1.module_el8.10.0+4331+0683c9c1.noarch.rpm 0831fdbf4e0ab5756be36baa4eb52bacb7a292b881040424cb56242bf3060977
noarch npm-11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1.noarch.rpm 15dc265687e93859a4b6a59a7954cfad9bba5bf46c98354b2ceaf0efb47e53a0
noarch nodejs-packaging-2021.06-6.module_el8.10.0+4086+70facd4a.noarch.rpm 318c493f93f2190506361306b5759e5e65eee18e3a8d85b195c800d8b7064bc0
noarch nodejs-nodemon-3.1.14-2.module_el8.10.0+4250+09238ed4.noarch.rpm 9af610bfd34078e749211d051d0a58ec3936da900b69e735bc529b46435cf37f
noarch nodejs-packaging-bundler-2021.06-6.module_el8.10.0+4086+70facd4a.noarch.rpm f4b4a25dc07327deb51619715aae6bd35d22e29ccfc97141c0b61de3a1995eee
ppc64le nodejs-devel-24.22.1-1.module_el8.10.0+4331+0683c9c1.ppc64le.rpm 1199c6595520b2648e641dbb262b008c0f1e6c7e6dde0d73ec78b6c592cd2271
ppc64le v8-13.6-devel-13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1.ppc64le.rpm 77b7ba361440110ec67c1a10df35f663edef4f297b93e390ac8a76445c15d66d
ppc64le nodejs-24.22.1-1.module_el8.10.0+4331+0683c9c1.ppc64le.rpm e177ece1062928770d06c1cf634c96fe25da97b96c4ae53f753567104eb7b1e3
ppc64le nodejs-full-i18n-24.22.1-1.module_el8.10.0+4331+0683c9c1.ppc64le.rpm e2d6ed7b4ac5b66a4a2ac0c2e209737cd5d073b636a92ba27b2cbaf641ea2907
ppc64le nodejs-libs-24.22.1-1.module_el8.10.0+4331+0683c9c1.ppc64le.rpm e39359ce9d39df95cfd1a4b419a119f9a1f1e53712da37f060c7213d58933df8
s390x nodejs-full-i18n-24.22.1-1.module_el8.10.0+4331+0683c9c1.s390x.rpm 1610b6537dfd96255d45b9d03059c452d2886085668c71e11ab4d75fec87f36b
s390x v8-13.6-devel-13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1.s390x.rpm 253459a016fb5a3b452e84add75d077b0d916d910f29bcb4e65698283c566c22
s390x nodejs-devel-24.22.1-1.module_el8.10.0+4331+0683c9c1.s390x.rpm 9ba0698b8c0aa3a8d44550649af3d45456ba030f2569b283cf6bd05f88ddf978
s390x nodejs-libs-24.22.1-1.module_el8.10.0+4331+0683c9c1.s390x.rpm daabe0b134d5fd4cce34dd5c41205e7b8f376d1b260a30c9d2d21da8b91480ad
s390x nodejs-24.22.1-1.module_el8.10.0+4331+0683c9c1.s390x.rpm f6ee0003aa9a5a9c78fc2ae7e71faec9c5954237961e8e3d487866daf370a372
x86_64 nodejs-devel-24.22.1-1.module_el8.10.0+4331+0683c9c1.x86_64.rpm 3f2bd8519b5711fd067e3ff7fac07c81c2d24e5c25972c1731c9a0768b39b037
x86_64 nodejs-full-i18n-24.22.1-1.module_el8.10.0+4331+0683c9c1.x86_64.rpm 6119d24d7d4e0d51d56a8941f4ddfc10255735214d9c31ca5fba2a431f4db877
x86_64 v8-13.6-devel-13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1.x86_64.rpm 633f791ef784cf5375c8607911aec870734faa9a843a67d033cdcf25b5e6c017
x86_64 nodejs-24.22.1-1.module_el8.10.0+4331+0683c9c1.x86_64.rpm 6cfd3486d64439feb8fce8c3243956a9e7ee43c04230b8eedc3089547064f0cb
x86_64 nodejs-libs-24.22.1-1.module_el8.10.0+4331+0683c9c1.x86_64.rpm f40c8b6c18eefb70a09c74f4aa5ec2778dae9a3d6829ae764b16702f938c19ad
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.