[ALSA-2026:92378] Important: nodejs:24 security, bug fix, and enhancement update
Type:
security
Severity:
important
Release date:
2026-10-29
Description:
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911) * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483) * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069) * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482) * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074) * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071) * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481) * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073) * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072) Bug Fix(es) and Enhancement(s): * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 nodejs-devel-24.22.1-3.module_el9.8.0+333+788f3075.aarch64.rpm 1296218febd9318dc278ab1a7b3370a314221ce1667b21c84f1396ffb228ed5a
aarch64 nodejs-libs-24.22.1-3.module_el9.8.0+333+788f3075.aarch64.rpm 582c618aee95a42659b0eb12ddcc8256ab93129187d4d2df30e82daed3fb3e92
aarch64 nodejs-24.22.1-3.module_el9.8.0+333+788f3075.aarch64.rpm 7131bd62113c362fef2cef61bc8f5bc99918fe869df251acaa500d13fc753fd8
aarch64 nodejs-full-i18n-24.22.1-3.module_el9.8.0+333+788f3075.aarch64.rpm c92f5cd464364412647823afd4eaf1abf3bf00a43a6a916cbfd04375c2cda13a
aarch64 v8-13.6-devel-13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075.aarch64.rpm fe6408595ff1f9a5cd5d7d941861266c8337a3c7eb2faa93895080f3a3b5b858
noarch nodejs-nodemon-3.1.14-3.module_el9.8.0+292+f4eaf8b2.noarch.rpm 34593bae84e3eda22d3c85db93eb84f883d07844a6d2c91217637b2c000e7e3b
noarch npm-11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075.noarch.rpm 442795afc36a7ec1e9ce83b5781c33baaf22e24656524d879b0d4c6422c66b8c
noarch nodejs-packaging-bundler-2021.06-6.module_el9.7.0+209+ecf6523e.noarch.rpm 704a51a642368ad73aefcbfa86b6b81f61c5541bc314bfdc63475e674964be6a
noarch nodejs-docs-24.22.1-3.module_el9.8.0+333+788f3075.noarch.rpm 831068979c6542e17652977b79229f02013732a37f0478d3e1b3bceeac6388a0
noarch nodejs-packaging-2021.06-6.module_el9.7.0+209+ecf6523e.noarch.rpm e12d6593295b63bbaffb1d59469018386e8cf5428b60b3671861a3b9e68d1fc4
ppc64le nodejs-libs-24.22.1-3.module_el9.8.0+333+788f3075.ppc64le.rpm 2d0614342b211369b423fc8e2607e738e7da955745eb5be1128914bfb2040148
ppc64le nodejs-full-i18n-24.22.1-3.module_el9.8.0+333+788f3075.ppc64le.rpm 87102fd996cead82794b52b8dbff4e21ac8ced6ab188466b228e5fb9681db36d
ppc64le nodejs-24.22.1-3.module_el9.8.0+333+788f3075.ppc64le.rpm 88255c1729ffcd81414f040a6767c5cabb1e735028a794ccca501761f0135f89
ppc64le nodejs-devel-24.22.1-3.module_el9.8.0+333+788f3075.ppc64le.rpm d37863b0bc0db935a50dd304435b6d3ddb54358ea9bc4718e2426947913dd79a
ppc64le v8-13.6-devel-13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075.ppc64le.rpm db02ed8156985589f6b142bb4a2a62c5a0c93a0fc7b25aea32b52973c78c4475
s390x nodejs-libs-24.22.1-3.module_el9.8.0+333+788f3075.s390x.rpm 26f9a223c7f2c8a1ac1abdc0df676e157310f5067ca99f64fb7184a646f0e6bb
s390x nodejs-devel-24.22.1-3.module_el9.8.0+333+788f3075.s390x.rpm 497a55906215cb9659724738299b79aed4ec14f5bad8ad3bb86ca84718fe1d41
s390x nodejs-full-i18n-24.22.1-3.module_el9.8.0+333+788f3075.s390x.rpm 5d16176c867cac11f52f4ba9b37432627197f6eb5500713cbfa551e2cb66b726
s390x nodejs-24.22.1-3.module_el9.8.0+333+788f3075.s390x.rpm 7eb20b6c5f511e00a3f7cee231332f83155531d847213e786f7a0cb2fc4e31f4
s390x v8-13.6-devel-13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075.s390x.rpm 8a75c143022f6274be6e6085f7838fc8dc3015d6ca46c20e67bd8dd252e57490
x86_64 nodejs-full-i18n-24.22.1-3.module_el9.8.0+333+788f3075.x86_64.rpm 7b148b8dc0216a12017216505a8ae222a768d2aaa9c32b04eb75c95823c1a328
x86_64 nodejs-libs-24.22.1-3.module_el9.8.0+333+788f3075.x86_64.rpm a1377608bc9c25f91ec7844a7f187a923c6c4cd6be471b77fe3e1ed25b581a58
x86_64 v8-13.6-devel-13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075.x86_64.rpm c15130fdb475208a6c944bf2e28368fbf9c713566c6d87b47b968b557bf5fdde
x86_64 nodejs-devel-24.22.1-3.module_el9.8.0+333+788f3075.x86_64.rpm d398ae2ee85f8390a40325f262c8202e4230211be4350f5e1e0b067ee55689c5
x86_64 nodejs-24.22.1-3.module_el9.8.0+333+788f3075.x86_64.rpm e882288732950239423b81300492244d8778c671c05d173554f0e7589abf149e
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.