RLSA-2026:35891 — Important: nodejs:24 security, bug fix, and enhancement update

Summary

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

* undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

* undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

* undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

* undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

* undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

* nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

* Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-186580)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

Release	Package	Fixed in
Rocky Linux · 9	nodejs-nodemon	0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2
Rocky Linux · 9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40153+4d595597
Rocky Linux · 9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40165+d075e3f2
Rocky Linux · 9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40052+e32ea525

Vulnerabilities 15

High 7.7

CVE-2026-48618

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
High 7.5

CVE-2026-12151

undici WebSocket client vulnerable to denial of service via fragment count bypass

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that ea…

undici undici renovate prism Debian Ubuntu Azure Linux Wolfi npm

Jun 17, 2026
High 7.5

CVE-2026-48933

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2G…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
High 7.5

CVE-2026-6734

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless …

undici undici renovate code-server Debian Ubuntu Wolfi npm

Jun 17, 2026
High 7.4

CVE-2026-9697

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node's default trust store, ignoring user-configured ca, cert…

undici undici langfuse-3-worker renovate Debian Ubuntu Azure Linux Wolfi npm

Jun 17, 2026
Medium 5.9

CVE-2026-48615

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
Medium 5.9

CVE-2026-9678

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

Impact: Undici's cache interceptor incorrectly classifies some responses as cacheable when the upstream Cache-Control header uses whitespace-padded qualified private or no-cache field names such as private=" authorization" or no-cache="\tauthorization". The p…

undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm

Jun 17, 2026
Medium 5.6

CVE-2026-48930

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to …

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
Medium 5.3

CVE-2026-42338

ip-address: XSS in Address6 HTML-emitting methods

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressEr…

beaugunderson ip-address langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm

May 12, 2026
Medium 5.3

CVE-2026-48619

A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Ou…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
Medium 4.3

CVE-2026-48934

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability af…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
Medium 4.2

CVE-2026-48928

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnera…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
Low 3.7

CVE-2026-11525

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the th…

undici undici renovate prism Debian Ubuntu Azure Linux Wolfi npm

Jun 17, 2026
Low 3.7

CVE-2026-6733

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatch…

undici undici renovate prism Debian Ubuntu Wolfi npm

Jun 17, 2026
Low 3.3

CVE-2026-48935

A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=2476810
report
https://bugzilla.redhat.com/show_bug.cgi?id=2489980
report
https://bugzilla.redhat.com/show_bug.cgi?id=2490000
report
https://bugzilla.redhat.com/show_bug.cgi?id=2490006
report
https://bugzilla.redhat.com/show_bug.cgi?id=2490008
report
https://bugzilla.redhat.com/show_bug.cgi?id=2490018
report
https://bugzilla.redhat.com/show_bug.cgi?id=2490024
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493325
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493326
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493329
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493331
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493332
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493333
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493335
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493337

Important: nodejs:24 security, bug fix, and enhancement update

Summary

Fixed packages 4

Vulnerabilities 15

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth…

undici WebSocket client vulnerable to denial of service via fragment count bypass

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2G…

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When…

undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to …

ip-address: XSS in Address6 HTML-emitting methods

A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Ou…

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability af…

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnera…

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with…

References