RHSA-2026:61376HighCVSS 7.5

Red Hat Security Advisory: nodejs22 security update

Published
August 31, 2026
Last Modified
October 19, 2026

🔗 CVE IDs covered (10)

CVE-2026-56846 →CVE-2026-56850 →CVE-2026-58039 →CVE-2026-58040 →CVE-2026-58043 →CVE-2026-56847 →CVE-2026-56848 →CVE-2026-58042 →CVE-2026-58044 →CVE-2026-58045 →

📋 Description

CVE-2026-56846 — nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks CVE-2026-56847 — nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions CVE-2026-56848 — nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service CVE-2026-56850 — nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw CVE-2026-58039 — nodejs: Information disclosure due to improper permission enforcement CVE-2026-58040 — nodejs: HTTPS Agent TLS session reuse skips hostname verification CVE-2026-58042 — nodejs: Node.js: Denial of Service via DNS responses with excessive A records CVE-2026-58043 — nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58044 — nodejs: Node.js: Request smuggling via HTTP client header truncation CVE-2026-58045 — nodejs: Node.js: Denial of Service vulnerability

🎯 Affected products39

  • Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-1:22.23.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-1:22.23.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-1:22.23.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-1:22.23.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-debuginfo-1:22.23.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-debuginfo-1:22.23.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-debuginfo-1:22.23.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-debuginfo-1:22.23.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-devel-1:22.23.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-devel-1:22.23.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-devel-1:22.23.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-devel-1:22.23.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-docs-1:22.23.2-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-full-i18n-1:22.23.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-full-i18n-1:22.23.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-full-i18n-1:22.23.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-full-i18n-1:22.23.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-libs-1:22.23.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-libs-1:22.23.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-libs-1:22.23.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-libs-1:22.23.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-libs-debuginfo-1:22.23.2-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-libs-debuginfo-1:22.23.2-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-libs-debuginfo-1:22.23.2-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-libs-debuginfo-1:22.23.2-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-npm-1:10.9.8-1.22.23.2.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-npm-1:10.9.8-1.22.23.2.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-npm-1:10.9.8-1.22.23.2.1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs-npm-1:10.9.8-1.22.23.2.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +9 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, restrict network access to Node.js applications utilizing HTTP/2 to trusted clients only, by implementing firewall rules or network access controls. If HTTP/2 functionality is not essential for the application, consider disabling it in the Node.js configuration to prevent exploitation. Always ensure that any service restarts or reloads are performed carefully to avoid service disruption. Workaround: Avoid using the trace_events.createTracing().enable() function in environments that rely on the Node.js Permission Model for file system isolation. Be aware that avoiding this function disables dynamic trace log generation, which may impact performance profiling, APM monitoring, and diagnostic workflows. Workaround: Restrict network access to Node.js HTTP/2 listeners to trusted clients only. If HTTP/2 is not required, disable it to remove the vulnerable handler from the attack surface. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, avoid enabling the experimental Node.js Permission Model by not using the `--experimental-permission` flag. Additionally, ensure that untrusted Node.js workloads are executed within robust operating system isolation primitives, such as Linux containers or cgroups, to limit potential impact. Workaround: To mitigate this issue, Node.js applications should be designed to explicitly configure unique HTTPS agents for each distinct target host. Alternatively, applications can avoid TLS session caching when making outbound HTTPS requests to varied third-party endpoints using shared client instances. Implementing these application-level changes will prevent the vulnerable behavior of skipping hostname verification. Applications may require a restart to apply these changes. Workaround: If unused, avoid dns.resolveAny() (prefer narrower resolvers such as resolve4 / lookup). Use trusted DNS resolvers and block untrusted DNS paths. Note that replacing dns.resolveAny() with narrower resolvers may break application features that depend on retrieving non-IP records, such as MX or TXT. Workaround: Avoid enabling the Node.js Permission Model by not using the `--permission` flag when starting Node.js applications. This prevents the vulnerable enforcement mechanism from being active. Disabling the Permission Model may remove an intended security layer if your application relies on it for sandboxing.

🔗 References (6)