Skip to content
OpenAdvisories
High RHSA-2026:84589 2 CVEs

Red Hat Security Advisory: nodejs:22 security update

Published Oct 20, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream nodejs 1:22.23.2-2.module+el9.6.0+25055+19201b10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream nodejs-debuginfo 1:22.23.2-2.module+el9.6.0+25055+19201b10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream nodejs-debugsource 1:22.23.2-2.module+el9.6.0+25055+19201b10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream nodejs-devel 1:22.23.2-2.module+el9.6.0+25055+19201b10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream nodejs-docs 1:22.23.2-2.module+el9.6.0+25055+19201b10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream nodejs-full-i18n 1:22.23.2-2.module+el9.6.0+25055+19201b10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream nodejs-libs 1:22.23.2-2.module+el9.6.0+25055+19201b10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream nodejs-libs-debuginfo 1:22.23.2-2.module+el9.6.0+25055+19201b10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream nodejs-nodemon 0:3.1.14-2.module+el9.6.0+24789+4011c12f
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream nodejs-packaging 0:2021.06-4.module+el9.6.0+23473+45664c2d
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream nodejs-packaging-bundler 0:2021.06-4.module+el9.6.0+23473+45664c2d
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream npm 1:10.9.8-1.22.23.2.2.module+el9.6.0+25055+19201b10
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::appstream v8-12.4-devel 3:12.4.254.21-1.22.23.2.2.module+el9.6.0+25055+19201b10

Vulnerabilities 2

  • High 7.5
    CVE-2026-19534

    undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

    undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes …

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-9496

    pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

    Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s rege…

    prism lerna npm npm Debian Ubuntu Wolfi npm

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481394
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528759
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84589.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-9496
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-9496
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-9496
  • article
    https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2
  • article
    https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025
  • article
    https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084
  • report
    https://access.redhat.com/security/cve/CVE-2026-19534
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-19534
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-19534
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5