[ALSA-2026:73838] Important: nodejs:24 security, bug fix, and enhancement update
Type:
security
Severity:
important
Release date:
2026-10-15
Description:
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152) * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) Bug Fix(es) and Enhancement(s): * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-249189) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 nodejs-24.21.0-1.module_el9.8.0+321+1555b6a2.aarch64.rpm 00a4084ee2af008d81626b047ac6f4394a7b0a938e59d820f740d724bc379433
aarch64 v8-13.6-devel-13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2.aarch64.rpm 5281e6ea1201df8ad08ce5c23bfc8ff2c7b153d6b9d9aa7ccdaea19d711ca655
aarch64 nodejs-libs-24.21.0-1.module_el9.8.0+321+1555b6a2.aarch64.rpm 5ec621dac511c128e2c05a72575634ff4a4d11391354db682fd79b7303fa1246
aarch64 nodejs-full-i18n-24.21.0-1.module_el9.8.0+321+1555b6a2.aarch64.rpm 62c312b2688572036c41df43391f762286e8e47433447535e321390b342a40ee
aarch64 nodejs-devel-24.21.0-1.module_el9.8.0+321+1555b6a2.aarch64.rpm b2de78a3df30a75497056c41885d25bc9d4fc0ff4162c8e8694150a23ec63a2e
noarch nodejs-nodemon-3.1.14-3.module_el9.8.0+292+f4eaf8b2.noarch.rpm 34593bae84e3eda22d3c85db93eb84f883d07844a6d2c91217637b2c000e7e3b
noarch npm-11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2.noarch.rpm 3b671ea4309e16dd67563449867fcd5bf6bc6480d23b0d4db1a1575fd4ccb715
noarch nodejs-packaging-bundler-2021.06-6.module_el9.7.0+209+ecf6523e.noarch.rpm 704a51a642368ad73aefcbfa86b6b81f61c5541bc314bfdc63475e674964be6a
noarch nodejs-docs-24.21.0-1.module_el9.8.0+321+1555b6a2.noarch.rpm af3130313d30050827c59151b1aada7a5f51ada41e4ae3921be4e7f59930338a
noarch nodejs-packaging-2021.06-6.module_el9.7.0+209+ecf6523e.noarch.rpm e12d6593295b63bbaffb1d59469018386e8cf5428b60b3671861a3b9e68d1fc4
ppc64le v8-13.6-devel-13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2.ppc64le.rpm 396cfebd55b3a5e58dee6708e363f810fb05e73ca0f3b3582f48f08d1ac6f422
ppc64le nodejs-24.21.0-1.module_el9.8.0+321+1555b6a2.ppc64le.rpm 3ec46afb37e853509f09bc3d018a6489ec7ec1a8faebaeb9229f7e38fcbe8a6e
ppc64le nodejs-libs-24.21.0-1.module_el9.8.0+321+1555b6a2.ppc64le.rpm 4411586a9f6db56ac63fc9b6ba247b7869328db1c7112250995a45c181fdfa3e
ppc64le nodejs-full-i18n-24.21.0-1.module_el9.8.0+321+1555b6a2.ppc64le.rpm 51b6f43572324464abedd86c2b2e02c2a8185a89a0e578b788a31345a1f677af
ppc64le nodejs-devel-24.21.0-1.module_el9.8.0+321+1555b6a2.ppc64le.rpm 7d9e35459f885b927e1a6a0bebe331ce2f581e6921ee49f2f3a2af9c09291730
s390x nodejs-devel-24.21.0-1.module_el9.8.0+321+1555b6a2.s390x.rpm 2412c13a67ff5a7712fae78621177a569d409fffe9100417253ed2efb33d324d
s390x v8-13.6-devel-13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2.s390x.rpm 285e4127cd8a2a13ad7d844aa0e6540151c414fccb8f67468ac95179a5db7f20
s390x nodejs-full-i18n-24.21.0-1.module_el9.8.0+321+1555b6a2.s390x.rpm 63cf7a2e8897321d61abebceb3a61cba6bd371edd9cca0e2be72daa634d736e4
s390x nodejs-24.21.0-1.module_el9.8.0+321+1555b6a2.s390x.rpm 9347837c25ef3e3ce6e73ca3b22d2e20a2c452b042edf351135d866852b2f79e
s390x nodejs-libs-24.21.0-1.module_el9.8.0+321+1555b6a2.s390x.rpm cf67d07142bb8d8649241eca577fa98bdad141c4f53261d7dce00a790221ede9
x86_64 nodejs-full-i18n-24.21.0-1.module_el9.8.0+321+1555b6a2.x86_64.rpm 08126929e18f6c35e0b4f9462cd79469816a99e4bc2722b44f964a476984056c
x86_64 v8-13.6-devel-13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2.x86_64.rpm 77efe31ea12209828bede0304cc32f8a335f3f66936d46ff2bf915c41e104421
x86_64 nodejs-libs-24.21.0-1.module_el9.8.0+321+1555b6a2.x86_64.rpm 9a3e3428238c9daa1b974f5f0dcde83cce295db3d4e0c6f998ad7fd95d5cfdce
x86_64 nodejs-devel-24.21.0-1.module_el9.8.0+321+1555b6a2.x86_64.rpm 9d19ae2cdbcc29fe108af593235bc4672f9844fa6b94eeb83b65adcec93a562e
x86_64 nodejs-24.21.0-1.module_el9.8.0+321+1555b6a2.x86_64.rpm be034c9a003bef9b185dc9877878e3c7680103e6370311b769588bbd2526bdd0
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.