{"id":"ALSA-2026:7675","summary":"Important: nodejs24 security update","details":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.  \n\nSecurity Fix(es):  \n\n  * nodejs: Nodejs denial of service (CVE-2026-21637)\n  * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n  * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n  * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n  * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n  * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n  * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n  * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n  * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n  * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n  * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n  * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n  * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n  * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n  * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n  * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n  * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n  * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","modified":"2026-04-17T13:29:27.846059153Z","published":"2026-04-13T00:00:00Z","related":["CVE-2026-1525","CVE-2026-1526","CVE-2026-1527","CVE-2026-1528","CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717","CVE-2026-2229","CVE-2026-25547","CVE-2026-2581","CVE-2026-26996","CVE-2026-27135"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7675"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-1525"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-1526"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-1527"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-1528"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21637"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21710"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21711"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21712"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21713"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21714"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21715"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21716"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-21717"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-2229"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-25547"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-2581"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-26996"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-27135"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2431340"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2436942"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2441268"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2447140"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2447141"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2447142"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2447143"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2447144"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2447145"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2448754"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453037"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453151"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453152"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453157"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453158"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453160"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453161"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2453162"},{"type":"ADVISORY","url":"https://errata.almalinux.org/10/ALSA-2026-7675.html"}],"affected":[{"package":{"name":"nodejs24","ecosystem":"AlmaLinux:10","purl":"pkg:rpm/almalinux/nodejs24"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux10/ALSA-2026:7675.json"}},{"package":{"name":"nodejs24-devel","ecosystem":"AlmaLinux:10","purl":"pkg:rpm/almalinux/nodejs24-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux10/ALSA-2026:7675.json"}},{"package":{"name":"nodejs24-docs","ecosystem":"AlmaLinux:10","purl":"pkg:rpm/almalinux/nodejs24-docs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux10/ALSA-2026:7675.json"}},{"package":{"name":"nodejs24-full-i18n","ecosystem":"AlmaLinux:10","purl":"pkg:rpm/almalinux/nodejs24-full-i18n"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux10/ALSA-2026:7675.json"}},{"package":{"name":"nodejs24-libs","ecosystem":"AlmaLinux:10","purl":"pkg:rpm/almalinux/nodejs24-libs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux10/ALSA-2026:7675.json"}},{"package":{"name":"nodejs24-npm","ecosystem":"AlmaLinux:10","purl":"pkg:rpm/almalinux/nodejs24-npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.11.0-1.24.14.1.2.el10_1"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux10/ALSA-2026:7675.json"}}],"schema_version":"1.7.5"}