Summary
[1:24.14.1-2.0.2]
- Rebuild to correct NVR
[1:24.14.1-2.0.1]
- Update upstream references
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | nodejs24 | 1:24.14.1-2.0.2.el10_1 |
| Oracle Linux · 10 | nodejs24-devel | 1:24.14.1-2.0.2.el10_1 |
| Oracle Linux · 10 | nodejs24-docs | 1:24.14.1-2.0.2.el10_1 |
| Oracle Linux · 10 | nodejs24-full-i18n | 1:24.14.1-2.0.2.el10_1 |
| Oracle Linux · 10 | nodejs24-libs | 1:24.14.1-2.0.2.el10_1 |
| Oracle Linux · 10 | nodejs24-npm | 1:11.11.0-1.24.14.1.2.0.2.el10_1 |
Vulnerabilities 18
-
Critical 9.2
Uncontrolled Resource Consumption in @isaacs/brace-expansion
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern con…
-
High 8.7
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed…
-
High 7.5
undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compres…
-
High 7.5
undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in …
-
High 7.5
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `…
-
High 7.5
undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation
ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises sup…
-
High 7.5
nghttp2 Denial of service: Assertion failure due to the missing state validation
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2…
-
Medium 6.5
undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Wh…
-
Medium 5.9
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…
-
Medium 5.9
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, poten…
-
Medium 5.9CVE-2026-21717 Public exploit
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…
-
Medium 5.9
undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory fo…
-
Medium 5.7
A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malfor…
-
Medium 5.3
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the re…
-
Medium 5.3
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) …
-
Medium 4.6
undici is vulnerable to CRLF Injection via upgrade option
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP servic…
-
Low 3.3
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read p…
-
Low 3.3
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without t…