Summary
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | nodejs-nodemon | 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e |
| Rocky Linux · 8 | nodejs-nodemon | 0:3.1.14-2.module+el8.10.0+40278+50b003a3 |
| Rocky Linux · 8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40172+38f6fdd1 |
| Rocky Linux · 8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40171+8fa9c325 |
| Rocky Linux · 8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 |
Vulnerabilities 3
-
High 7.5CVE-2026-56846 Public exploit
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…
-
High 7.5CVE-2026-56848 Public exploit
A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…
-
High 7.5CVE-2026-58043 Public exploit
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…