Summary
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* nodejs: Nodejs denial of service (CVE-2026-21637)
* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)
* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)
* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | nodejs-nodemon | 0:3.0.3-1.module+el8.10.0+2084+ab509703 |
| Rocky Linux · 8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 |
Vulnerabilities 17
-
High 8.7
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed…
-
High 7.5
undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compres…
-
High 7.5
undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in …
-
High 7.5
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `…
-
High 7.5
undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation
ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises sup…
-
High 7.5
nghttp2 Denial of service: Assertion failure due to the missing state validation
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2…
-
Medium 6.5
undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Wh…
-
Medium 5.9
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…
-
Medium 5.9
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, poten…
-
Medium 5.9CVE-2026-21717 Public exploit
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…
-
Medium 5.9
undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory fo…
-
Medium 5.7
A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malfor…
-
Medium 5.3
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the re…
-
Medium 5.3
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) …
-
Medium 4.6
undici is vulnerable to CRLF Injection via upgrade option
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP servic…
-
Low 3.3
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read p…
-
Low 3.3
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without t…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2431340
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2441268
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2447140
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2447141
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2447142
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2447143
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2447144
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2447145
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2448754
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2453037
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2453151
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2453152
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2453157
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2453158
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2453160
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2453161
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2453162