Skip to content
OpenAdvisories
High RLSA-2026:7675 18 CVEs

Important: nodejs24 security update

Published Apr 15, 2026 · Updated Apr 15, 2026

Ecosystem: Rocky Linux

Summary

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Nodejs denial of service (CVE-2026-21637)

* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)

* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 10 nodejs24 1:24.14.1-2.el10_1

Vulnerabilities 18

  • Critical 9.2
    CVE-2026-25547

    Uncontrolled Resource Consumption in @isaacs/brace-expansion

    @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern con…

    isaacs brace-expansion renovate lerna Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-26996

    minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed…

    isaacs minimatch langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-1526

    undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

    The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compres…

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-1528

    undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

    ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in …

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-21710 Public exploit EPSS 25%

    A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-2229

    undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

    ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises sup…

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-27135

    nghttp2 Denial of service: Assertion failure due to the missing state validation

    nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2…

    nghttp2 nghttp2 nodejs cmake Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-1525

    undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

    Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Wh…

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-21637

    A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-21713

    A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, poten…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-21717 Public exploit

    A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2026-2581

    undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS

    This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory fo…

    undici undici renovate code-server Debian Ubuntu Wolfi npm
  • Medium 5.7
    CVE-2026-21712

    A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malfor…

    Node.js node nodejs nodejs Ubuntu Azure Linux Alpine
  • Medium 5.3
    CVE-2026-21711

    A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the re…

    Node.js node nodejs Ubuntu
  • Medium 5.3
    CVE-2026-21714

    A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 4.6
    CVE-2026-1527

    undici is vulnerable to CRLF Injection via upgrade option

    ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP servic…

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Low 3.3
    CVE-2026-21715

    A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read p…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.3
    CVE-2026-21716

    An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without t…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453162
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447142
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453160
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447144
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447140
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453161
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2436942
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453151
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453037
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447141
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453158
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453157
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453152
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2441268
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2448754
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447143
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2431340
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2447145