Skip to content
OpenAdvisories
Critical 1 exploited CVE RHSA-2026:98522 10 CVEs

Red Hat Security Advisory: nodejs:26 security, bug fix, and enhancement update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream nodejs 1:26.12.1-2.module+el9.9.0+25297+fc0af076
Red Hat · RHEL 9 enterprise_linux:9::appstream nodejs-debuginfo 1:26.12.1-2.module+el9.9.0+25297+fc0af076
Red Hat · RHEL 9 enterprise_linux:9::appstream nodejs-debugsource 1:26.12.1-2.module+el9.9.0+25297+fc0af076
Red Hat · RHEL 9 enterprise_linux:9::appstream nodejs-devel 1:26.12.1-2.module+el9.9.0+25297+fc0af076
Red Hat · RHEL 9 enterprise_linux:9::appstream nodejs-docs 1:26.12.1-2.module+el9.9.0+25297+fc0af076
Red Hat · RHEL 9 enterprise_linux:9::appstream nodejs-full-i18n 1:26.12.1-2.module+el9.9.0+25297+fc0af076
Red Hat · RHEL 9 enterprise_linux:9::appstream nodejs-libs 1:26.12.1-2.module+el9.9.0+25297+fc0af076
Red Hat · RHEL 9 enterprise_linux:9::appstream nodejs-libs-debuginfo 1:26.12.1-2.module+el9.9.0+25297+fc0af076
Red Hat · RHEL 9 enterprise_linux:9::appstream nodejs-nodemon 0:3.1.14-2.module+el9.9.0+25283+460aabd3
Red Hat · RHEL 9 enterprise_linux:9::appstream nodejs-packaging 0:2021.06-6.module+el9.9.0+24923+ac50c00f
Red Hat · RHEL 9 enterprise_linux:9::appstream nodejs-packaging-bundler 0:2021.06-6.module+el9.9.0+24923+ac50c00f
Red Hat · RHEL 9 enterprise_linux:9::appstream npm 1:11.20.0-1.26.12.1.2.module+el9.9.0+25297+fc0af076
Red Hat · RHEL 9 enterprise_linux:9::appstream v8-14.6-devel 3:14.6.202.34-1.26.12.1.2.module+el9.9.0+25297+fc0af076

Vulnerabilities 10

  • Critical 9.2
    CVE-2026-111497 Exploited Public exploit EPSS 83%

    Out-of-Bounds Write in Google Brotli Decoder

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

    Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex
    KEV Oct 27, 2026
  • High 7.5
    CVE-2026-102276

    brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the …

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-102278

    brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sit…

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-109869

    undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content cod…

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-87018

    undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

    undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trus…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-105482 Public exploit

    A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-105483 Public exploit

    A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-106069 Public exploit

    A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-109383

    undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool,…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-109829

    undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

    undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original …

    undici undici renovate node-undici Debian Ubuntu Wolfi npm

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542700
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542707
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553656
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553677
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553678
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553679
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2558973
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2559870
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2559873
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2559875
  • article
    https://issues.redhat.com/browse/RHEL-289767
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98522.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-87018
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-87018
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-87018
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm
  • report
    https://access.redhat.com/security/cve/CVE-2026-102276
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-102276
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-102276
  • article
    https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc
  • article
    https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c
  • article
    https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc
  • article
    https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3
  • article
    https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p
  • report
    https://access.redhat.com/security/cve/CVE-2026-102278
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-102278
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-102278
  • article
    https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b
  • article
    https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c
  • article
    https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db
  • article
    https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7
  • report
    https://access.redhat.com/security/cve/CVE-2026-105482
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-105482
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-105482
  • article
    https://nodejs.org/en/blog/release/v22.23.4
  • article
    https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
  • report
    https://access.redhat.com/security/cve/CVE-2026-105483