RHSA-2026:61386 — Red Hat Security Advisory: nodejs:24 security update

Fixed packages 13

Release	Package	Fixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs	1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-debuginfo	1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-debugsource	1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-devel	1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-docs	1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-full-i18n	1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-libs	1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-libs-debuginfo	1:24.19.0-1.module+el9.8.0+24708+e71d2e1d
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-nodemon	0:3.1.14-3.module+el9.8.0+24708+e71d2e1d
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-packaging	0:2021.06-6.module+el9.8.0+24708+e71d2e1d
Red Hat · RHEL 9 enterprise_linux:9::appstream	nodejs-packaging-bundler	0:2021.06-6.module+el9.8.0+24708+e71d2e1d
Red Hat · RHEL 9 enterprise_linux:9::appstream	npm	1:11.17.0-1.24.19.0.1.module+el9.8.0+24708+e71d2e1d
Red Hat · RHEL 9 enterprise_linux:9::appstream	v8-13.6-devel	3:13.6.233.17-1.24.19.0.1.module+el9.8.0+24708+e71d2e1d

Vulnerabilities 11

High 7.5

CVE-2026-56846 Public exploit

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
High 7.5

CVE-2026-56848 Public exploit

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
High 7.5

CVE-2026-58043 Public exploit

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 30, 2026
Medium 6.3

CVE-2026-58040 Public exploit

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 30, 2026
Medium 6.2

CVE-2026-58045 Public exploit

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
Medium 5.9

CVE-2026-58042 Public exploit

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
Medium 5.3

CVE-2026-58041 Public exploit

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to con…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
Medium 4.1

CVE-2026-56850 Public exploit

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 30, 2026
Low 3.7

CVE-2026-58044 Public exploit

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
Low 3.3

CVE-2026-56847 Public exploit

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 30, 2026
Low 3.3

CVE-2026-58039 Public exploit

A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 31, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509171
report
https://bugzilla.redhat.com/show_bug.cgi?id=2510856
report
https://bugzilla.redhat.com/show_bug.cgi?id=2511089
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61386.json
report
https://access.redhat.com/security/cve/CVE-2026-56846
advisory
https://www.cve.org/CVERecord?id=CVE-2026-56846
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56846
article
https://nodejs.org/en/blog/vulnerability/july-2026-security-releases
report
https://access.redhat.com/security/cve/CVE-2026-56847
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509178
advisory
https://www.cve.org/CVERecord?id=CVE-2026-56847
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56847
report
https://access.redhat.com/security/cve/CVE-2026-56848
advisory
https://www.cve.org/CVERecord?id=CVE-2026-56848
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56848
report
https://access.redhat.com/security/cve/CVE-2026-56850
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509179
advisory
https://www.cve.org/CVERecord?id=CVE-2026-56850
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-56850
report
https://access.redhat.com/security/cve/CVE-2026-58039
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509653
advisory
https://www.cve.org/CVERecord?id=CVE-2026-58039
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58039
article
https://nodejs.org/en/blog/vulnerability
report
https://access.redhat.com/security/cve/CVE-2026-58040
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509175
advisory
https://www.cve.org/CVERecord?id=CVE-2026-58040
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58040
report
https://access.redhat.com/security/cve/CVE-2026-58041
report
https://bugzilla.redhat.com/show_bug.cgi?id=2510858
advisory
https://www.cve.org/CVERecord?id=CVE-2026-58041
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58041
report
https://access.redhat.com/security/cve/CVE-2026-58042
report
https://bugzilla.redhat.com/show_bug.cgi?id=2510854
advisory
https://www.cve.org/CVERecord?id=CVE-2026-58042
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-58042
report
https://access.redhat.com/security/cve/CVE-2026-58043
advisory
https://www.cve.org/CVERecord?id=CVE-2026-58043

Red Hat Security Advisory: nodejs:24 security update

Fixed packages 13

Vulnerabilities 11

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to con…

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…

A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

References