RHSA-2026:62416HighCVSS 8.6

Red Hat Security Advisory: nodejs:22 security update

Published
September 2, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (16)

CVE-2026-58045 →CVE-2026-11822 →CVE-2026-14257 →CVE-2026-56846 →CVE-2026-56850 →CVE-2026-58042 →CVE-2026-58044 →CVE-2026-69152 →CVE-2026-69192 →CVE-2026-11824 →CVE-2026-54272 →CVE-2026-56847 →CVE-2026-56848 →CVE-2026-58039 →CVE-2026-58040 →CVE-2026-58043 →

📋 Description

CVE-2026-11822 — sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11824 — sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 CVE-2026-14257 — brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function CVE-2026-54272 — ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification CVE-2026-56846 — nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks CVE-2026-56847 — nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions CVE-2026-56848 — nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service CVE-2026-56850 — nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw CVE-2026-58039 — nodejs: Information disclosure due to improper permission enforcement CVE-2026-58040 — nodejs: HTTPS Agent TLS session reuse skips hostname verification CVE-2026-58042 — nodejs: Node.js: Denial of Service via DNS responses with excessive A records CVE-2026-58043 — nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58044 — nodejs: Node.js: Request smuggling via HTTP client header truncation CVE-2026-58045 — nodejs: Node.js: Denial of Service vulnerability CVE-2026-69152 — brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVE-2026-69192 — ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

🎯 Affected products44

  • Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.src (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-debuginfo-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-debuginfo-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-debuginfo-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-debuginfo-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-debugsource-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-debugsource-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-debugsource-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-debugsource-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-devel-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-devel-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-devel-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-devel-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-docs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.noarch (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-full-i18n-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-full-i18n-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-full-i18n-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-full-i18n-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-libs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-libs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-libs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-libs-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.x86_64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-libs-debuginfo-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.aarch64 (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-libs-debuginfo-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • nodejs-libs-debuginfo-1:22.23.2-1.module+el9.6.0+24769+299a7e3a.s390x (nodejs:22) as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • +14 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Do not pass untrusted or user-controlled input to brace-expansion's expand() function or to libraries that use it for glob pattern matching (such as minimatch or glob). Validate and sanitize any brace patterns before expansion. Where possible, upgrade to brace-expansion 1.1.17, 2.1.3, 3.0.3, or 5.0.8 which add a maxLength option that bounds accumulated output. As an additional defense-in-depth measure, enforce memory limits on Node.js processes using operating system resource controls such as cgroups or Kubernetes resource limits (spec.containers[].resources.limits.memory) to prevent a single process from exhausting system memory and causing a wider outage. Workaround: To mitigate this issue, restrict network access to Node.js applications utilizing HTTP/2 to trusted clients only, by implementing firewall rules or network access controls. If HTTP/2 functionality is not essential for the application, consider disabling it in the Node.js configuration to prevent exploitation. Always ensure that any service restarts or reloads are performed carefully to avoid service disruption. Workaround: Avoid using the trace_events.createTracing().enable() function in environments that rely on the Node.js Permission Model for file system isolation. Be aware that avoiding this function disables dynamic trace log generation, which may impact performance profiling, APM monitoring, and diagnostic workflows. Workaround: Restrict network access to Node.js HTTP/2 listeners to trusted clients only. If HTTP/2 is not required, disable it to remove the vulnerable handler from the attack surface. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, avoid enabling the experimental Node.js Permission Model by not using the `--experimental-permission` flag. Additionally, ensure that untrusted Node.js workloads are executed within robust operating system isolation primitives, such as Linux containers or cgroups, to limit potential impact. Workaround: To mitigate this issue, Node.js applications should be designed to explicitly configure unique HTTPS agents for each distinct target host. Alternatively, applications can avoid TLS session caching when making outbound HTTPS requests to varied third-party endpoints using shared client instances. Implementing these application-level changes will prevent the vulnerable behavior of skipping hostname verification. Applications may require a restart to apply these changes. Workaround: If unused, avoid dns.resolveAny() (prefer narrower resolvers such as resolve4 / lookup). Use trusted DNS resolvers and block untrusted DNS paths. Note that replacing dns.resolveAny() with narrower resolvers may break application features that depend on retrieving non-IP records, such as MX or TXT. Workaround: Avoid enabling the Node.js Permission Model by not using the `--permission` flag when starting Node.js applications. This prevents the vulnerable enforcement mechanism from being active. Disabling the Permission Model may remove an intended security layer if your application relies on it for sandboxing. Workaround: To mitigate this vulnerability, do not pass untrusted input to the expand() function.

🔗 References (12)