Summary
Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.
Security Fix(es):
* brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
* ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | nodejs | 1:22.23.1-6.el10_2 |
| AlmaLinux · 10 | nodejs-devel | 1:22.23.1-6.el10_2 |
| AlmaLinux · 10 | nodejs-docs | 1:22.23.1-6.el10_2 |
| AlmaLinux · 10 | nodejs-full-i18n | 1:22.23.1-6.el10_2 |
| AlmaLinux · 10 | nodejs-libs | 1:22.23.1-6.el10_2 |
| AlmaLinux · 10 | nodejs-npm | 1:10.9.8-1.22.23.1.6.el10_2 |
Vulnerabilities 3
-
High 7.7
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all deco…
-
High 7.5
brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace grou…
-
High 7.5
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing a…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-14257
-
report
https://access.redhat.com/security/cve/CVE-2026-69152
-
report
https://access.redhat.com/security/cve/CVE-2026-69192
-
report
https://bugzilla.redhat.com/2506433
-
report
https://bugzilla.redhat.com/2510722
-
report
https://bugzilla.redhat.com/2510801
-
advisory
https://errata.almalinux.org/10/ALSA-2026-55541.html