Skip to content
OpenAdvisories
High RLSA-2026:98102 8 CVEs

Important: nodejs:24 security update

Published Nov 11, 2026 · Updated Nov 11, 2026

Ecosystem: Rocky Linux

Summary

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)

* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

* sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 (CVE-2026-119373)

* sqlite: sqlite: Arbitrary code execution via crafted session changesets (CVE-2026-119379)

* sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index (CVE-2026-119374)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 5

ReleasePackageFixed in
Rocky Linux · 8 nodejs-nodemon 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e
Rocky Linux · 8 nodejs-nodemon 0:3.1.14-2.module+el8.10.0+40278+50b003a3
Rocky Linux · 8 nodejs-packaging 0:2021.06-6.module+el8.10.0+40048+6d99f608
Rocky Linux · 8 nodejs-packaging 0:2021.06-6.module+el8.10.0+40171+8fa9c325
Rocky Linux · 8 nodejs-packaging 0:2021.06-6.module+el8.10.0+40172+38f6fdd1

Vulnerabilities 8

  • High 7.8
    CVE-2026-119373

    SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()

    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-119374

    SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()

    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when d…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-119379

    SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()

    SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changes…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-102276

    brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the …

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-102278

    brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sit…

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-109869

    undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content cod…

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-87018

    undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

    undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trus…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-109383

    undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool,…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542700
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542707
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553656
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553677
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553678
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2563953
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2563955
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2563978
  • advisory
    https://access.redhat.com/errata/RHSA-2026:98102