Summary
nodejs
[1:24.21.0-1.0.1]
- Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497]
- Expose the decoder block-switch error and add regression coverage
- Require the patched system Brotli for shared builds
nodejs-nodemon
nodejs-packaging
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | nodejs | 1:24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5 |
| Oracle Linux · 8 | nodejs-devel | 1:24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5 |
| Oracle Linux · 8 | nodejs-docs | 1:24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5 |
| Oracle Linux · 8 | nodejs-full-i18n | 1:24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5 |
| Oracle Linux · 8 | nodejs-libs | 1:24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5 |
| Oracle Linux · 8 | nodejs-nodemon | 0:3.1.14-2.module+el8.10.0+91054+4b1a799c |
| Oracle Linux · 8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+91054+4b1a799c |
| Oracle Linux · 8 | nodejs-packaging-bundler | 0:2021.06-6.module+el8.10.0+91054+4b1a799c |
| Oracle Linux · 8 | npm | 1:11.19.0-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5 |
| Oracle Linux · 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5 |
Vulnerabilities 13
-
Critical 9.2
Out-of-Bounds Write in Google Brotli Decoder
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …
KEV Oct 27, 2026 -
High 7.5
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the …
-
High 7.5
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sit…
-
High 7.4CVE-2026-105482 Public exploit
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …
-
High 7.4CVE-2026-105483 Public exploit
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…
-
High 7.4CVE-2026-106069 Public exploit
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…
-
Medium 6.7CVE-2026-106072 Public exploit
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint whe…
-
Medium 6.5CVE-2026-105481 Public exploit
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the…
-
Medium 6.3
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARAC…
-
Medium 5.3
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan onc…
-
Medium 4.8CVE-2026-106074 Public exploit
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, a…
-
Low 3.6CVE-2026-106071 Public exploit
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…
-
Low 3.3CVE-2026-106073 Public exploit
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…