Summary
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
Bug Fix(es) and Enhancement(s):
* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | nodejs | 1:24.22.1-3.module+el9.8.0+40401+e24b8c95 |
| Rocky Linux · 9 | nodejs-nodemon | 0:3.1.14-3.module+el9.8.0+40281+14cc6568 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40165+d075e3f2 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.8.0+40164+8921ab53 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 |
| Rocky Linux · 9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40153+4d595597 |
Vulnerabilities 13
-
Critical 9.2
Out-of-Bounds Write in Google Brotli Decoder
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …
KEV Oct 27, 2026 -
High 7.5
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the …
-
High 7.5
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sit…
-
High 7.4CVE-2026-105482 Public exploit
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …
-
High 7.4CVE-2026-105483 Public exploit
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…
-
High 7.4CVE-2026-106069 Public exploit
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…
-
Medium 6.7CVE-2026-106072 Public exploit
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint whe…
-
Medium 6.5CVE-2026-105481 Public exploit
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the…
-
Medium 6.3
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARAC…
-
Medium 5.3
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan onc…
-
Medium 4.8CVE-2026-106074 Public exploit
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, a…
-
Low 3.6CVE-2026-106071 Public exploit
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…
-
Low 3.3CVE-2026-106073 Public exploit
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2542596
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2542700
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2542706
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2542707
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2558973
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2559870
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2559873
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2559875
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2560016
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2560018
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2560019
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2560021
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2560022
-
advisory
https://access.redhat.com/errata/RHSA-2026:92378