ALSA-2026:92378 — Important: nodejs:24 security, bug fix, and enhancement update

Summary

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 10

Release	Package	Fixed in
AlmaLinux · 9	nodejs	1:24.22.1-3.module_el9.8.0+333+788f3075
AlmaLinux · 9	nodejs-devel	1:24.22.1-3.module_el9.8.0+333+788f3075
AlmaLinux · 9	nodejs-docs	1:24.22.1-3.module_el9.8.0+333+788f3075
AlmaLinux · 9	nodejs-full-i18n	1:24.22.1-3.module_el9.8.0+333+788f3075
AlmaLinux · 9	nodejs-libs	1:24.22.1-3.module_el9.8.0+333+788f3075
AlmaLinux · 9	nodejs-nodemon	3.1.14-3.module_el9.8.0+292+f4eaf8b2
AlmaLinux · 9	nodejs-packaging	2021.06-6.module_el9.7.0+209+ecf6523e
AlmaLinux · 9	nodejs-packaging-bundler	2021.06-6.module_el9.7.0+209+ecf6523e
AlmaLinux · 9	npm	1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075
AlmaLinux · 9	v8-13.6-devel	3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075

Vulnerabilities 13

Critical 9.2

CVE-2026-111497 Exploited Public exploit EPSS 83%

Out-of-Bounds Write in Google Brotli Decoder

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex

Oct 22, 2026
KEV Oct 27, 2026
High 7.5

CVE-2026-102276

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the …

juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm

Sep 28, 2026
High 7.5

CVE-2026-102278

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sit…

juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm

Sep 28, 2026
High 7.4

CVE-2026-105482 Public exploit

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Oct 23, 2026
High 7.4

CVE-2026-105483 Public exploit

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Oct 23, 2026
High 7.4

CVE-2026-106069 Public exploit

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Oct 23, 2026
Medium 6.7

CVE-2026-106072 Public exploit

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint whe…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Oct 23, 2026
Medium 6.5

CVE-2026-105481 Public exploit

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Oct 23, 2026
Medium 6.3

CVE-2026-101911

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARAC…

beaugunderson ip-address renovate prism Debian Ubuntu Wolfi npm

Sep 28, 2026
Medium 5.3

CVE-2026-102277

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan onc…

juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm

Sep 28, 2026
Medium 4.8

CVE-2026-106074 Public exploit

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, a…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Oct 23, 2026
Low 3.6

CVE-2026-106071 Public exploit

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Oct 23, 2026
Low 3.3

CVE-2026-106073 Public exploit

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Oct 23, 2026

References

report
https://access.redhat.com/security/cve/CVE-2026-101911
report
https://access.redhat.com/security/cve/CVE-2026-102276
report
https://access.redhat.com/security/cve/CVE-2026-102277
report
https://access.redhat.com/security/cve/CVE-2026-102278
report
https://access.redhat.com/security/cve/CVE-2026-105481
report
https://access.redhat.com/security/cve/CVE-2026-105482
report
https://access.redhat.com/security/cve/CVE-2026-105483
report
https://access.redhat.com/security/cve/CVE-2026-106069
report
https://access.redhat.com/security/cve/CVE-2026-106071
report
https://access.redhat.com/security/cve/CVE-2026-106072
report
https://access.redhat.com/security/cve/CVE-2026-106073
report
https://access.redhat.com/security/cve/CVE-2026-106074
report
https://access.redhat.com/security/cve/CVE-2026-111497
report
https://bugzilla.redhat.com/2542596
report
https://bugzilla.redhat.com/2542700
report
https://bugzilla.redhat.com/2542706
report
https://bugzilla.redhat.com/2542707
report
https://bugzilla.redhat.com/2558973
report
https://bugzilla.redhat.com/2559870
report
https://bugzilla.redhat.com/2559873
report
https://bugzilla.redhat.com/2559875
report
https://bugzilla.redhat.com/2560016
report
https://bugzilla.redhat.com/2560018
report
https://bugzilla.redhat.com/2560019
report
https://bugzilla.redhat.com/2560021
report
https://bugzilla.redhat.com/2560022
advisory
https://errata.almalinux.org/9/ALSA-2026-92378.html

Important: nodejs:24 security, bug fix, and enhancement update

Summary

Fixed packages 10

Vulnerabilities 13

Out-of-Bounds Write in Google Brotli Decoder

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint whe…

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the…

ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, a…

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…

References