{"id":"ALSA-2026:7350","summary":"Important: nodejs:24 security update","details":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n  * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n  * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n  * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n  * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n  * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n  * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n  * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","modified":"2026-04-17T13:29:31.080318225Z","published":"2026-04-09T00:00:00Z","related":["CVE-2026-1525","CVE-2026-1526","CVE-2026-1527","CVE-2026-1528","CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717","CVE-2026-2229","CVE-2026-25547","CVE-2026-2581","CVE-2026-26996","CVE-2026-27135"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7350"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-1525"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-1526"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-1527"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-1528"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21637"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21710"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21711"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21712"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21713"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21714"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21715"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21716"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21717"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-2229"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-25547"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-2581"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-26996"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-27135"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2431340"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2436942"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2441268"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2447140"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2447141"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2447142"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2447143"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2447144"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2447145"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2448754"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453037"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453151"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453152"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453157"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453158"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453160"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453161"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453162"},{"type":"ADVISORY","url":"https://errata.almalinux.org/9/ALSA-2026-7350.html"}],"affected":[{"package":{"name":"nodejs","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/nodejs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:7350.json"}},{"package":{"name":"nodejs-devel","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/nodejs-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:7350.json"}},{"package":{"name":"nodejs-docs","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/nodejs-docs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:7350.json"}},{"package":{"name":"nodejs-full-i18n","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/nodejs-full-i18n"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:7350.json"}},{"package":{"name":"nodejs-libs","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/nodejs-libs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.module_el9.7.0+222+ef1c61e1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:7350.json"}},{"package":{"name":"nodejs-nodemon","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/nodejs-nodemon"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-3.module_el9.7.0+209+ecf6523e"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:7350.json"}},{"package":{"name":"nodejs-packaging","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/nodejs-packaging"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+209+ecf6523e"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:7350.json"}},{"package":{"name":"nodejs-packaging-bundler","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/nodejs-packaging-bundler"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-6.module_el9.7.0+198+8bf605ba"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:7350.json"}},{"package":{"name":"npm","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:7350.json"}},{"package":{"name":"v8-13.6-devel","ecosystem":"AlmaLinux:9","purl":"pkg:rpm/almalinux/v8-13.6-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:7350.json"}}],"schema_version":"1.7.5"}