RHSA-2026:61383 — Red Hat Security Advisory: nodejs:22 security update

Fixed packages 13

Release	Package	Fixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs	1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-debuginfo	1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-debugsource	1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-devel	1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-docs	1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-full-i18n	1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-libs	1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-libs-debuginfo	1:22.23.2-1.module+el9.8.0+24709+804d6b5b
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-nodemon	0:3.1.14-2.module+el9.8.0+24709+804d6b5b
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-packaging	0:2021.06-6.module+el9.8.0+24709+804d6b5b
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-packaging-bundler	0:2021.06-6.module+el9.8.0+24709+804d6b5b
Red Hat · RHEL 9 enterprise_linux:9::appstream	npm	1:10.9.8-1.22.23.2.1.module+el9.8.0+24709+804d6b5b
Red Hat · RHEL 9 enterprise_linux:9::appstream	v8-12.4-devel	3:12.4.254.21-1.22.23.2.1.module+el9.8.0+24709+804d6b5b

Vulnerabilities 10

High 7.5

CVE-2026-56846 Public exploit

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
High 7.5

CVE-2026-56848 Public exploit

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
High 7.5

CVE-2026-58043 Public exploit

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 30, 2026
Medium 6.3

CVE-2026-58040 Public exploit

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 30, 2026
Medium 6.2

CVE-2026-58045 Public exploit

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
Medium 5.9

CVE-2026-58042 Public exploit

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
Medium 4.1

CVE-2026-56850 Public exploit

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 30, 2026
Low 3.7

CVE-2026-58044 Public exploit

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
Low 3.3

CVE-2026-56847 Public exploit

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 30, 2026
Low 3.3

CVE-2026-58039 Public exploit

A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 31, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509171
report
https://bugzilla.redhat.com/show_bug.cgi?id=2510856
report
https://bugzilla.redhat.com/show_bug.cgi?id=2511089
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61383.json
report
https://access.redhat.com/security/cve/CVE-2026-56846
advisory
https://www.cve.org/CVERecord?id=CVE-2026-56846
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56846
article
https://nodejs.org/en/blog/vulnerability/july-2026-security-releases
report
https://access.redhat.com/security/cve/CVE-2026-56847
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509178
advisory
https://www.cve.org/CVERecord?id=CVE-2026-56847
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56847
report
https://access.redhat.com/security/cve/CVE-2026-56848
advisory
https://www.cve.org/CVERecord?id=CVE-2026-56848
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56848
report
https://access.redhat.com/security/cve/CVE-2026-56850
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509179
advisory
https://www.cve.org/CVERecord?id=CVE-2026-56850
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56850
report
https://access.redhat.com/security/cve/CVE-2026-58039
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509653
advisory
https://www.cve.org/CVERecord?id=CVE-2026-58039
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58039
article
https://nodejs.org/en/blog/vulnerability
report
https://access.redhat.com/security/cve/CVE-2026-58040
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509175
advisory
https://www.cve.org/CVERecord?id=CVE-2026-58040
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58040
report
https://access.redhat.com/security/cve/CVE-2026-58042
report
https://bugzilla.redhat.com/show_bug.cgi?id=2510854
advisory
https://www.cve.org/CVERecord?id=CVE-2026-58042
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58042
report
https://access.redhat.com/security/cve/CVE-2026-58043
advisory
https://www.cve.org/CVERecord?id=CVE-2026-58043
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58043
report
https://access.redhat.com/security/cve/CVE-2026-58044
report
https://bugzilla.redhat.com/show_bug.cgi?id=2510853
advisory
https://www.cve.org/CVERecord?id=CVE-2026-58044

Red Hat Security Advisory: nodejs:22 security update

Fixed packages 13

Vulnerabilities 10

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…

A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

References