Red Hat Security Advisory: nodejs:26 security update

Fixed packages 13

Vulnerabilities 26

• High 7.7
  CVE-2026-48618

  A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• High 7.5
  CVE-2026-19534

  undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

  undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes …

  undici undici renovate prism Debian Ubuntu Wolfi npm
  Sep 4, 2026
• High 7.5
  CVE-2026-48933

  A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2G…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• High 7.5
  CVE-2026-56846 Public exploit

  A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• High 7.5
  CVE-2026-56848 Public exploit

  A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• High 7.5
  CVE-2026-58043 Public exploit

  A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 30, 2026
• High 7.4
  CVE-2026-13697

  undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

  undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be sto…

  undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  Jul 29, 2026
• High 7.4
  CVE-2026-84961

  undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

  undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIde…

  undici undici prism lerna Debian Ubuntu Wolfi npm
  Sep 4, 2026
• High 7.4
  CVE-2026-85152

  undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

  undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or …

  undici undici node-undici node-undici Debian Ubuntu npm
  Sep 4, 2026
• Medium 6.3
  CVE-2026-58040 Public exploit

  An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 30, 2026
• Medium 6.2
  CVE-2026-58045 Public exploit

  A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• Medium 5.9
  CVE-2026-48615

  A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 5.9
  CVE-2026-58042 Public exploit

  A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• Medium 5.6
  CVE-2026-48930

  A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to …

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 5.3
  CVE-2026-48619

  A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Ou…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 5.3
  CVE-2026-58041 Public exploit

  A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to con…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• Medium 4.3
  CVE-2026-48934

  A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability af…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 4.2
  CVE-2026-48928

  A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnera…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Medium 4.1
  CVE-2026-56850 Public exploit

  A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 30, 2026
• Low 3.7
  CVE-2026-48931

  A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent t…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 22, 2026
• Low 3.7
  CVE-2026-58044 Public exploit

  A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Aug 4, 2026
• Low 3.3
  CVE-2026-48935

  A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jun 26, 2026
• Low 3.3
  CVE-2026-48936

  A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `-…

  Node.js node nodejs Ubuntu
  Jun 26, 2026
• Low 3.3
  CVE-2026-56847 Public exploit

  A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 30, 2026
• Low 3.3
  CVE-2026-58039 Public exploit

  A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 31, 2026
• Low 1.8
  CVE-2026-48617

  A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. Thi…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 18, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2490521
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2491494
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493325
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493326
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493329
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493331
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493333
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493335
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493336
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2493337
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2508485
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2509171
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2509175
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2509178
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2509179
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2509653
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510853
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510854
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510857
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2510858
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2511089
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528717
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528735
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2528759
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_97855.json
• report
  https://access.redhat.com/security/cve/CVE-2026-13697
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-13697
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-13697
• article
  https://cna.openjsf.org/security-advisories.html
• article
  https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272
• report
  https://access.redhat.com/security/cve/CVE-2026-19534
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-19534
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-19534
• article
  https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5
• report
  https://access.redhat.com/security/cve/CVE-2026-48615
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-48615