Skip to content
OpenAdvisories
High RLSA-2026:98113 8 CVEs

Important: nodejs:22 security, bug fix, and enhancement update

Published Nov 11, 2026 · Updated Nov 11, 2026

Ecosystem: Rocky Linux

Summary

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)

* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)

* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)

* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)

* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

Bug Fix(es) and Enhancement(s):

* nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-8] (JIRA:Rocky Linux-289618)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 3

ReleasePackageFixed in
Rocky Linux · 8 nodejs-packaging 0:2021.06-6.module+el8.10.0+40048+6d99f608
Rocky Linux · 8 nodejs-packaging 0:2021.06-6.module+el8.10.0+40171+8fa9c325
Rocky Linux · 8 nodejs-packaging 0:2021.06-6.module+el8.10.0+40172+38f6fdd1

Vulnerabilities 8

  • High 7.5
    CVE-2026-102276

    brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the …

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-102278

    brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sit…

    juliangruber brace-expansion renovate prism Debian Ubuntu Azure Linux Wolfi npm
  • High 7.5
    CVE-2026-109869

    undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

    undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content cod…

    undici undici renovate prism Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-87018

    undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

    undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trus…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-105482 Public exploit

    A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-106069 Public exploit

    A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-109383

    undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool,…

    undici undici renovate node-undici Debian Ubuntu Wolfi npm
  • High 7.4
    CVE-2026-109829

    undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

    undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original …

    undici undici renovate node-undici Debian Ubuntu Wolfi npm

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542700
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2542707
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553656
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553677
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553678
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2553679
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2559873
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2559875
  • advisory
    https://access.redhat.com/errata/RHSA-2026:98113