Skip to content
OpenAdvisories
Critical RHSA-2026:7675 18 CVEs

Red Hat Security Advisory: nodejs24 security update

Published Apr 13, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.1 nodejs24 1:24.14.1-2.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 nodejs24-debuginfo 1:24.14.1-2.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 nodejs24-debugsource 1:24.14.1-2.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 nodejs24-devel 1:24.14.1-2.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 nodejs24-docs 1:24.14.1-2.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 nodejs24-full-i18n 1:24.14.1-2.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 nodejs24-libs 1:24.14.1-2.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 nodejs24-libs-debuginfo 1:24.14.1-2.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 nodejs24-npm 1:11.11.0-1.24.14.1.2.el10_1

Vulnerabilities 18

  • Critical 9.2
    CVE-2026-25547

    Uncontrolled Resource Consumption in @isaacs/brace-expansion

    @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern con…

    isaacs brace-expansion renovate lerna Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-26996

    minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed…

    isaacs minimatch langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-1526

    undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

    The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compres…

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-1528

    undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

    ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in …

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-21710 Public exploit EPSS 25%

    A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-2229

    undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

    ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises sup…

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-27135

    nghttp2 Denial of service: Assertion failure due to the missing state validation

    nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2…

    nghttp2 nghttp2 nodejs cmake Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-1525

    undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

    Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Wh…

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-21637

    A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-21713

    A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, poten…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-21717 Public exploit

    A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-2581

    undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS

    This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory fo…

    undici undici renovate code-server Debian Ubuntu Wolfi npm
  • Medium 5.7
    CVE-2026-21712

    A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malfor…

    Node.js node nodejs nodejs Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-21711

    A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the re…

    Node.js node nodejs Ubuntu
  • Medium 5.3
    CVE-2026-21714

    A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 4.6
    CVE-2026-1527

    undici is vulnerable to CRLF Injection via upgrade option

    ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP servic…

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Low 3.3
    CVE-2026-21715

    A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read p…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.3
    CVE-2026-21716

    An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without t…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2431340
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2436942
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2441268
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447140
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447141
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447142
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447143
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447144
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447145
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2448754
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453037
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453151
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453152
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453157
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453158
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453160
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453161
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453162
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7675.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-1525
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-1525
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-1525
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://cwe.mitre.org/data/definitions/444.html
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm
  • article
    https://hackerone.com/reports/3556037
  • article
    https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6
  • report
    https://access.redhat.com/security/cve/CVE-2026-1526
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-1526
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-1526
  • article
    https://datatracker.ietf.org/doc/html/rfc7692
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q
  • article
    https://hackerone.com/reports/3481206
  • report
    https://access.redhat.com/security/cve/CVE-2026-1527
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-1527
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-1527
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq
  • article
    https://hackerone.com/reports/3487198