[ALSA-2026:98113] Important: nodejs:22 security, bug fix, and enhancement update
Type:
security
Severity:
important
Release date:
2026-11-12
Description:
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869) * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018) * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383) * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829) * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069) * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482) Bug Fix(es) and Enhancement(s): * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-8] (JIRA:RHEL-289618) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 npm-10.9.9-1.22.23.4.2.module_el8.10.0+4358+709b81be.aarch64.rpm 17681678a18b529975ff07c5eb6f16a713f2e4dd7330a83a0b9b65bf614c4eca
aarch64 v8-12.4-devel-12.4.254.21-1.22.23.4.2.module_el8.10.0+4358+709b81be.aarch64.rpm 2523c71a3610effb78c3b309b3076af5467ca4ac8f98e664e63c045fc3c4dd94
aarch64 nodejs-libs-22.23.4-2.module_el8.10.0+4358+709b81be.aarch64.rpm 37fa023eb9afee9bee2850fda8fe48eca95bc07a0611e3b87fbf9584cf5797a6
aarch64 nodejs-devel-22.23.4-2.module_el8.10.0+4358+709b81be.aarch64.rpm 724926d601ce67c658dc08965fd1347c0d99c38e72ab8e3e539a40b5bd92addf
aarch64 nodejs-full-i18n-22.23.4-2.module_el8.10.0+4358+709b81be.aarch64.rpm bfd581d69fc6b8e219a3e643ffd629037313234897a3454edb52f0134b42a3bf
aarch64 nodejs-22.23.4-2.module_el8.10.0+4358+709b81be.aarch64.rpm ca0d4ea4c5d144802b575d8d2b4697a95ddb68935d61072a3c4f1fe5c4ad2c19
noarch nodejs-packaging-bundler-2021.06-6.module_el8.10.0+4158+e796f37f.noarch.rpm 95549e780e9ad76b8e49f9c9db940d99cb8260f37e3d9cf05df2baaf6182e412
noarch nodejs-packaging-2021.06-6.module_el8.10.0+4158+e796f37f.noarch.rpm aaede6e40164690ca8a8b2229ad4ad4e0faea8ce4f2d6cfb3358572d8576dace
noarch nodejs-nodemon-3.1.14-3.module_el8.10.0+4358+709b81be.noarch.rpm f8ff0f5fb3778f5475dca6d8ef824e2586c47704bc533ef83a49c98f5ef5bcd4
noarch nodejs-docs-22.23.4-2.module_el8.10.0+4358+709b81be.noarch.rpm fcc0741feae2f533dab9db6c2a792866d02d5288b333d164f2e8a51d7e5c6d70
ppc64le nodejs-22.23.4-2.module_el8.10.0+4358+709b81be.ppc64le.rpm 54804faacc0f6efda722d3154f2fec05e174013316dfc211c2e28f3e9ff9df16
ppc64le v8-12.4-devel-12.4.254.21-1.22.23.4.2.module_el8.10.0+4358+709b81be.ppc64le.rpm b30c7d0d8f59b6d74de89e0f1c09a53ca9758dbe8f210abffdbfea2e08a571e0
ppc64le nodejs-devel-22.23.4-2.module_el8.10.0+4358+709b81be.ppc64le.rpm c85c717c2f483ec601c63c410757731a94047708d9a635f80ab05a3c8167eb67
ppc64le nodejs-libs-22.23.4-2.module_el8.10.0+4358+709b81be.ppc64le.rpm dfc6798edac879c19761df05e770b3983f9e6c19aaffc449688dc2425498a880
ppc64le npm-10.9.9-1.22.23.4.2.module_el8.10.0+4358+709b81be.ppc64le.rpm e38210247735dd9f00d26439523c2c302f99c0f795495eec8ad643e61931fe71
ppc64le nodejs-full-i18n-22.23.4-2.module_el8.10.0+4358+709b81be.ppc64le.rpm f72882b0a963add1cb6f8c7dc14ab73cfc2b9d9765ed49d7e228665e65c4aec8
s390x npm-10.9.9-1.22.23.4.2.module_el8.10.0+4358+709b81be.s390x.rpm 0ab96542f6587704c2de54f2646eaaeada31b051492c5cd85432804a865fd575
s390x nodejs-libs-22.23.4-2.module_el8.10.0+4358+709b81be.s390x.rpm 21839a7c083053b6d2ed34b6c9c60f1b60656ec7917ba6e5793ee7121a2f89ad
s390x nodejs-full-i18n-22.23.4-2.module_el8.10.0+4358+709b81be.s390x.rpm 49f4bdb08a172a8062eb48b97d449f1703bba7787e808e4a2efe7632ec89989e
s390x v8-12.4-devel-12.4.254.21-1.22.23.4.2.module_el8.10.0+4358+709b81be.s390x.rpm 6a273623c9b8f4282b7909bac4567329eff0423b1a25b1b1a805b3411bd4419c
s390x nodejs-22.23.4-2.module_el8.10.0+4358+709b81be.s390x.rpm 8ed0db8258a5399817b1c55279cf59b35212b8e847c70eb9e34c9b35214ee816
s390x nodejs-devel-22.23.4-2.module_el8.10.0+4358+709b81be.s390x.rpm aa3595cac401b914f709c909b6f0c43c181e7750edd299236664b04028eac296
x86_64 nodejs-22.23.4-2.module_el8.10.0+4358+709b81be.x86_64.rpm 1d32a1087d791d784ed70baff6df391c981153f9d9ac0c35a113c2ee06d2ce4d
x86_64 nodejs-libs-22.23.4-2.module_el8.10.0+4358+709b81be.x86_64.rpm 20a3a55c1d67995e8242d335ad06f458d0bc30ee4988edf9fa8b5c96162c17f9
x86_64 npm-10.9.9-1.22.23.4.2.module_el8.10.0+4358+709b81be.x86_64.rpm 31998759ad8f0e6a34cf2e22e327dd158c759c5ecdfc8834a56e996332f2d4b6
x86_64 nodejs-full-i18n-22.23.4-2.module_el8.10.0+4358+709b81be.x86_64.rpm 6db4e926bf6d9ccdbdc791aa4b048332abc888ce87a2317c17c642bce7acf107
x86_64 nodejs-devel-22.23.4-2.module_el8.10.0+4358+709b81be.x86_64.rpm 96c7c91544208249726cbd0283c78ae350a10d96c4c9997d054a1efcccab1cbe
x86_64 v8-12.4-devel-12.4.254.21-1.22.23.4.2.module_el8.10.0+4358+709b81be.x86_64.rpm f1ceed3fb7657482404e35e3ef206c10e2d7b27867e75c8797cce5fc7a599d81
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.