RHSA-2026:96226HighCVSS 7.8

Red Hat Security Advisory: nodejs:24 security update

Published
November 9, 2026
Last Modified
November 10, 2026

🔗 CVE IDs covered (10)

CVE-2026-102278 →CVE-2026-109869 →CVE-2026-119373 →CVE-2026-87018 →CVE-2026-109383 →CVE-2026-118764 →CVE-2026-119374 →CVE-2026-119379 →CVE-2026-19534 →CVE-2026-102276 →

📋 Description

CVE-2026-19534 — undici: undici: Denial of Service via unrequested WebSocket subprotocol CVE-2026-87018 — undici: undici: Denial of Service via TLS renegotiation with mismatched certificate CVE-2026-102276 — brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns CVE-2026-102278 — brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns CVE-2026-109383 — undici: undici: Certificate validation bypass via dropped TLS options in Agent CVE-2026-109869 — undici: undici: Denial of Service via unhandled stream error on excessive content encodings CVE-2026-118764 — minimatch: minimatch: Denial of Service via crafted glob pattern expansion CVE-2026-119373 — sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5 CVE-2026-119374 — sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index CVE-2026-119379 — sqlite: sqlite: Arbitrary code execution via crafted session changesets

🎯 Affected products41

  • Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.src (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-docs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.noarch (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:24.22.1-5.module+el9.8.0+25292+33251f3b.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:24.22.1-5.module+el9.8.0+25292+33251f3b.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +11 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Avoid passing untrusted, user-controlled input as glob patterns to minimatch. If dynamic input is necessary, enforce strict limits on pattern length and path segments, set optimization levels below level 2, and apply execution timeouts or container CPU/memory constraints to prevent denial-of-service via resource exhaustion.

🔗 References (11)