RLSA-2026:97855 — Important: nodejs:26 security update

Summary

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation (CVE-2026-48617)

* nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance (CVE-2026-48931)

* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

* nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

* Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

* nodejs: Node.js: Local server can be started without network permission via Permission API flaw (CVE-2026-48936)

* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

* undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697)

* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)

* nodejs: HTTPS Agent TLS session reuse skips hostname verification (CVE-2026-58040)

* nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions (CVE-2026-56847)

* nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw (CVE-2026-56850)

* nodejs: Information disclosure due to improper permission enforcement (CVE-2026-58039)

* nodejs: Node.js: Request smuggling via HTTP client header truncation (CVE-2026-58044)

* nodejs: Node.js: Denial of Service via DNS responses with excessive A records (CVE-2026-58042)

* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)

* nodejs: Node.js: Denial of Service vulnerability (CVE-2026-58045)

* nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator (CVE-2026-58041)

* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

* undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)

* undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)

* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 5

Release	Package	Fixed in
Rocky Linux · 9	nodejs-nodemon	0:3.1.14-1.module+el9.8.0+40263+faa47049
Rocky Linux · 9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40052+e32ea525
Rocky Linux · 9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40165+d075e3f2
Rocky Linux · 9	nodejs-packaging	0:2021.06-6.module+el9.8.0+40164+8921ab53
Rocky Linux · 9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40153+4d595597

Vulnerabilities 26

High 7.7

CVE-2026-48618

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
High 7.5

CVE-2026-19534

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes …

undici undici renovate prism Debian Ubuntu Wolfi npm

Sep 4, 2026
High 7.5

CVE-2026-48933

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2G…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
High 7.5

CVE-2026-56846 Public exploit

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
High 7.5

CVE-2026-56848 Public exploit

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
High 7.5

CVE-2026-58043 Public exploit

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 30, 2026
High 7.4

CVE-2026-13697

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be sto…

undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm

Jul 29, 2026
High 7.4

CVE-2026-84961

undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIde…

undici undici prism lerna Debian Ubuntu Wolfi npm

Sep 4, 2026
High 7.4

CVE-2026-85152

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or …

undici undici node-undici node-undici Debian Ubuntu npm

Sep 4, 2026
Medium 6.3

CVE-2026-58040 Public exploit

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 30, 2026
Medium 6.2

CVE-2026-58045 Public exploit

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
Medium 5.9

CVE-2026-48615

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
Medium 5.9

CVE-2026-58042 Public exploit

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
Medium 5.6

CVE-2026-48930

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to …

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
Medium 5.3

CVE-2026-48619

A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Ou…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
Medium 5.3

CVE-2026-58041 Public exploit

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to con…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
Medium 4.3

CVE-2026-48934

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability af…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
Medium 4.2

CVE-2026-48928

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnera…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
Medium 4.1

CVE-2026-56850 Public exploit

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 30, 2026
Low 3.7

CVE-2026-48931

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent t…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jun 22, 2026
Low 3.7

CVE-2026-58044 Public exploit

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…

Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi

Aug 4, 2026
Low 3.3

CVE-2026-48935

A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine

Jun 26, 2026
Low 3.3

CVE-2026-48936

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `-…

Node.js node nodejs Ubuntu

Jun 26, 2026
Low 3.3

CVE-2026-56847 Public exploit

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 30, 2026
Low 3.3

CVE-2026-58039 Public exploit

A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jul 31, 2026
Low 1.8

CVE-2026-48617

A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. Thi…

Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

Jun 18, 2026

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=2490521
report
https://bugzilla.redhat.com/show_bug.cgi?id=2491494
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493325
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493326
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493329
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493331
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493332
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493333
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493335
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493336
report
https://bugzilla.redhat.com/show_bug.cgi?id=2493337
report
https://bugzilla.redhat.com/show_bug.cgi?id=2508485
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509171
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509175
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509178
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509179
report
https://bugzilla.redhat.com/show_bug.cgi?id=2509653
report
https://bugzilla.redhat.com/show_bug.cgi?id=2510853
report
https://bugzilla.redhat.com/show_bug.cgi?id=2510854
report
https://bugzilla.redhat.com/show_bug.cgi?id=2510856
report
https://bugzilla.redhat.com/show_bug.cgi?id=2510857
report
https://bugzilla.redhat.com/show_bug.cgi?id=2510858
report
https://bugzilla.redhat.com/show_bug.cgi?id=2511089
report
https://bugzilla.redhat.com/show_bug.cgi?id=2528717
report
https://bugzilla.redhat.com/show_bug.cgi?id=2528735
report
https://bugzilla.redhat.com/show_bug.cgi?id=2528759
advisory
https://access.redhat.com/errata/RHSA-2026:97855

Important: nodejs:26 security update

Summary

Fixed packages 5

Vulnerabilities 26

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth…

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2G…

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…

A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When…

A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to …

A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Ou…

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to con…

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability af…

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnera…

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent t…

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…

A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with…

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `-…

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…

A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. Thi…

References