Red Hat Security Advisory: nodejs:24 security update

Fixed packages 13

Vulnerabilities 17

• High 8.7
  CVE-2026-26996

  minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

  minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed…

  isaacs minimatch langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  Feb 20, 2026
• High 7.5
  CVE-2026-1526

  undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

  The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compres…

  undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  Mar 12, 2026
• High 7.5
  CVE-2026-1528

  undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

  ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in …

  undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  Mar 12, 2026
• High 7.5
  CVE-2026-21710 Public exploit EPSS 25%

  A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026
• High 7.5
  CVE-2026-2229

  undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

  ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises sup…

  undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  Mar 12, 2026
• High 7.5
  CVE-2026-27135

  nghttp2 Denial of service: Assertion failure due to the missing state validation

  nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2…

  nghttp2 nghttp2 nodejs cmake Debian Ubuntu Azure Linux Alpine
  Mar 18, 2026
• Medium 6.5
  CVE-2026-1525

  undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

  Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Wh…

  undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  Mar 12, 2026
• Medium 5.9
  CVE-2026-21637

  A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 20, 2026
• Medium 5.9
  CVE-2026-21713

  A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, poten…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026
• Medium 5.9
  CVE-2026-21717 Public exploit

  A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026
• Medium 5.9
  CVE-2026-2581

  undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS

  This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory fo…

  undici undici renovate code-server Debian Ubuntu Wolfi npm
  Mar 12, 2026
• Medium 5.7
  CVE-2026-21712

  A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malfor…

  Node.js node nodejs nodejs Ubuntu Azure Linux Alpine
  Mar 30, 2026
• Medium 5.3
  CVE-2026-21711

  A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the re…

  Node.js node nodejs Ubuntu
  Mar 30, 2026
• Medium 5.3
  CVE-2026-21714

  A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) …

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026
• Medium 4.6
  CVE-2026-1527

  undici is vulnerable to CRLF Injection via upgrade option

  ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP servic…

  undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  Mar 12, 2026
• Low 3.3
  CVE-2026-21715

  A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read p…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026
• Low 3.3
  CVE-2026-21716

  An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without t…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431340
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2441268
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447140
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447141
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447142
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447143
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447144
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447145
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2448754
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2453037
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2453151
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2453152
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2453157
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2453158
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2453160
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2453161
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2453162
• article
  https://issues.redhat.com/browse/RHEL-151374
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7670.json
• report
  https://access.redhat.com/security/cve/CVE-2026-1525
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-1525
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-1525
• article
  https://cna.openjsf.org/security-advisories.html
• article
  https://cwe.mitre.org/data/definitions/444.html
• article
  https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm
• article
  https://hackerone.com/reports/3556037
• article
  https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6
• report
  https://access.redhat.com/security/cve/CVE-2026-1526
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-1526
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-1526
• article
  https://datatracker.ietf.org/doc/html/rfc7692
• article
  https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q
• article
  https://hackerone.com/reports/3481206
• report
  https://access.redhat.com/security/cve/CVE-2026-1527
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-1527
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-1527
• article
  https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq
• article
  https://hackerone.com/reports/3487198