Skip to content
OpenAdvisories
High RLSA-2026:96226 10 CVEs

Important: nodejs:24 security update

Published Nov 10, 2026 · Updated Nov 10, 2026

Ecosystem: Rocky Linux

Summary

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)

* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

* minimatch: minimatch: Denial of Service via crafted glob pattern expansion (CVE-2026-118764)

* sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)

* sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)

* sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
Rocky Linux · 9 nodejs-packaging 0:2021.06-6.module+el9.7.0+40165+d075e3f2
Rocky Linux · 9 nodejs-packaging 0:2021.06-6.module+el9.7.0+40052+e32ea525
Rocky Linux · 9 nodejs-packaging 0:2021.06-6.module+el9.7.0+40153+4d595597
Rocky Linux · 9 nodejs-packaging 0:2021.06-6.module+el9.8.0+40164+8921ab53

Vulnerabilities 10

  • High 7.8
    CVE-2026-119373

    SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()

    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-119374

    SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()

    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when d…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-119379

    SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()

    SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changes…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-102276

    brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the …

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-102278

    brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sit…

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-109869

    undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content cod…

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-19534

    undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

    undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes …

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-87018

    undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

    undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trus…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-109383

    undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool,…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • Medium 6.9
    CVE-2026-118764 Public exploit

    minimatch: potential denial of service via globparts amplification

    minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands atta…

    isaacs minimatch langfuse-3-worker renovate Debian Ubuntu Wolfi npm

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2528759
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542700
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542707
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553656
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553677
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553678
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2563607
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2563953
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2563955
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2563978
  • advisory
    https://access.redhat.com/errata/RHSA-2026:96226