Skip to content
OpenAdvisories
High ALSA-2026:96088 9 CVEs

Important: nodejs24 security, bug fix, and enhancement update

Published Nov 9, 2026 · Updated Nov 10, 2026

Ecosystem: AlmaLinux

Summary

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)
* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)
* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)
* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)
* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

Bug Fix(es) and Enhancement(s):

* nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-295759)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 6

ReleasePackageFixed in
AlmaLinux · 10 nodejs24 1:24.22.1-3.el10_2
AlmaLinux · 10 nodejs24-devel 1:24.22.1-3.el10_2
AlmaLinux · 10 nodejs24-docs 1:24.22.1-3.el10_2
AlmaLinux · 10 nodejs24-full-i18n 1:24.22.1-3.el10_2
AlmaLinux · 10 nodejs24-libs 1:24.22.1-3.el10_2
AlmaLinux · 10 nodejs24-npm 2:11.19.1-1.24.22.1.3.el10_2

Vulnerabilities 9

  • High 7.5
    CVE-2026-102276

    brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the …

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-102278

    brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sit…

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-109869

    undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content cod…

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-87018

    undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

    undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trus…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-105482 Public exploit

    A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-105483 Public exploit

    A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-106069 Public exploit

    A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-109383

    undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool,…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-109829

    undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

    undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original …

    undici undici renovate node-undici Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-102276
  • report
    https://access.redhat.com/security/cve/CVE-2026-102278
  • report
    https://access.redhat.com/security/cve/CVE-2026-105482
  • report
    https://access.redhat.com/security/cve/CVE-2026-105483
  • report
    https://access.redhat.com/security/cve/CVE-2026-106069
  • report
    https://access.redhat.com/security/cve/CVE-2026-109383
  • report
    https://access.redhat.com/security/cve/CVE-2026-109829
  • report
    https://access.redhat.com/security/cve/CVE-2026-109869
  • report
    https://access.redhat.com/security/cve/CVE-2026-87018
  • report
    https://bugzilla.redhat.com/2542700
  • report
    https://bugzilla.redhat.com/2542707
  • report
    https://bugzilla.redhat.com/2553656
  • report
    https://bugzilla.redhat.com/2553677
  • report
    https://bugzilla.redhat.com/2553678
  • report
    https://bugzilla.redhat.com/2553679
  • report
    https://bugzilla.redhat.com/2559870
  • report
    https://bugzilla.redhat.com/2559873
  • report
    https://bugzilla.redhat.com/2559875
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-96088.html