RHSA-2026:92378HighCVSS 8.1

Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

Published
October 29, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (13)

CVE-2026-101911 →CVE-2026-102276 →CVE-2026-102277 →CVE-2026-105481 →CVE-2026-105482 →CVE-2026-105483 →CVE-2026-106069 →CVE-2026-106072 →CVE-2026-102278 →CVE-2026-106071 →CVE-2026-106073 →CVE-2026-106074 →CVE-2026-111497 →

📋 Description

CVE-2026-101911 — ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-102276 — brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns CVE-2026-102277 — brace-expansion: brace-expansion: Denial of Service via crafted brace patterns CVE-2026-102278 — brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns CVE-2026-105481 — nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse CVE-2026-105482 — nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character CVE-2026-105483 — nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames CVE-2026-106069 — nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames CVE-2026-106071 — nodejs: nodejs: Permission model bypass via wildcard path matching flaw CVE-2026-106072 — nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification CVE-2026-106073 — nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() CVE-2026-106074 — nodejs: nodejs: predictable random values via snapshot entropy cache reuse CVE-2026-111497 — brotli: Out-of-Bounds Write in Google Brotli Decoder

🎯 Affected products41

  • Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.src (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-docs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.noarch (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +11 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating the bundled brace-expansion dependency to a version that contains the upstream fix (1.1.21, 2.1.7, 3.0.9, or 5.0.12, depending on the major version in use) resolves the issue. Workaround: Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends. Where operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled). Prefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers. Workaround: To mitigate, do not pass untrusted strings into dns.resolve; reject hostnames that contain embedded NUL bytes before DNS resolution. Limit which components may perform DNS lookups on attacker-influenced names, and restrict network reachability of those services. Workaround: To mitigate do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits into TLS clients such as tls.connect, https.request, or fetch. Restrict outbound TLS connections to trusted destinations only, and segment services that initiate TLS client connections from untrusted networks. Workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input. Workaround: If the Permission Model is unused, do not enable --permission. When using --allow-fs-read/--allow-fs-write, avoid wildcard grants placed as the sole root-level rule; prefer explicit directory prefixes without ambiguous wildcards. Combine application allowlists with OS confinement such as SELinux or container filesystem restrictions . Workaround: Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input. Where feasible, pin expected server certificates or public keys for sensitive outbound TLS. Restrict which destinations Node.js workloads may reach with egress controls. Workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal. Apply OS-level confinement (SELinux, containers) as defense in depth. Workaround: Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation. Prefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (16)