Summary
Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.
Security Fix(es):
* pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)
* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | nodejs | 1:22.23.2-3.el10_2 |
| AlmaLinux · 10 | nodejs-devel | 1:22.23.2-3.el10_2 |
| AlmaLinux · 10 | nodejs-docs | 1:22.23.2-3.el10_2 |
| AlmaLinux · 10 | nodejs-full-i18n | 1:22.23.2-3.el10_2 |
| AlmaLinux · 10 | nodejs-libs | 1:22.23.2-3.el10_2 |
| AlmaLinux · 10 | nodejs-npm | 1:10.9.8-1.22.23.2.3.el10_2 |
Vulnerabilities 2
-
High 7.5
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes …
-
High 7.5
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s rege…