Summary
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | nodejs-nodemon | 0:3.1.14-2.module+el9.8.0+40280+057606e8 |
| Rocky Linux · 9 | nodejs-nodemon | 0:3.1.14-2.module+el9.8.0+40264+d9b257bb |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40153+4d595597 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.8.0+40164+8921ab53 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40165+d075e3f2 |
Vulnerabilities 3
-
High 7.5CVE-2026-56846 Public exploit
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…
-
High 7.5CVE-2026-56848 Public exploit
A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…
-
High 7.5CVE-2026-58043 Public exploit
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…