Summary
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496)
* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | nodejs | 1:22.23.2-2.module+el9.8.0+40374+17512296 |
| Rocky Linux · 9 | nodejs-nodemon | 0:3.1.14-2.module+el9.8.0+40280+057606e8 |
| Rocky Linux · 9 | nodejs-nodemon | 0:3.1.14-2.module+el9.8.0+40264+d9b257bb |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40153+4d595597 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40165+d075e3f2 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.8.0+40164+8921ab53 |
Vulnerabilities 2
-
High 7.5
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes …
-
High 7.5
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s rege…