Skip to content
OpenAdvisories
High RHSA-2026:75864 2 CVEs

Red Hat Security Advisory: nodejs22 security update

Published Oct 6, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 11

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 nodejs 1:22.23.2-3.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 nodejs-debuginfo 1:22.23.2-3.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 nodejs-devel 1:22.23.2-3.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 nodejs-docs 1:22.23.2-3.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 nodejs-full-i18n 1:22.23.2-3.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 nodejs-libs 1:22.23.2-3.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 nodejs-libs-debuginfo 1:22.23.2-3.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 nodejs-npm 1:10.9.8-1.22.23.2.3.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 nodejs22 1:22.23.2-3.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 nodejs22-debuginfo 1:22.23.2-3.el10_2
Red Hat · RHEL 10 enterprise_linux:10.2 nodejs22-debugsource 1:22.23.2-3.el10_2

Vulnerabilities 2

  • High 7.5
    CVE-2026-19534

    undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

    undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes …

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-9496

    pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

    Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s rege…

    prism lerna npm npm Debian Ubuntu Wolfi npm

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481394
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528759
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_75864.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-9496
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-9496
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-9496
  • article
    https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2
  • article
    https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025
  • article
    https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084
  • report
    https://access.redhat.com/security/cve/CVE-2026-19534
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19534
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19534
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5