{"id":"RHSA-2026:98522","summary":"Red Hat Security Advisory: nodejs:26 security, bug fix, and enhancement update","modified":"2026-11-13T19:13:58.099319239Z","published":"2026-11-13T18:51:07Z","upstream":["CVE-2026-102276","CVE-2026-102278","CVE-2026-105482","CVE-2026-105483","CVE-2026-106069","CVE-2026-109383","CVE-2026-109829","CVE-2026-109869","CVE-2026-111497","CVE-2026-87018"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:98522"},{"type":"ARTICLE","url":"https://access.redhat.com/security/updates/classification/#important"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542700"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542707"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553656"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553677"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553678"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553679"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558973"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559870"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559873"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559875"},{"type":"ARTICLE","url":"https://issues.redhat.com/browse/RHEL-289767"},{"type":"ADVISORY","url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98522.json"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-87018"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-87018"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87018"},{"type":"ARTICLE","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-102276"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-102276"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-102278"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-102278"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-105482"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-105482"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105482"},{"type":"ARTICLE","url":"https://nodejs.org/en/blog/release/v22.23.4"},{"type":"ARTICLE","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-105483"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-105483"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105483"},{"type":"ARTICLE","url":"https://nodejs.org/en/blog/release/v24.22.1"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-106069"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-106069"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106069"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-109383"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-109383"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109383"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/commit/f75eac00ac17"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-109829"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-109829"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109829"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/commit/26c2bfb3def0"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-109869"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-109869"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/commit/b5084c7dc239"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-111497"},{"type":"ARTICLE","url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-015"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-111497"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497"},{"type":"ARTICLE","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"},{"type":"ARTICLE","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"affected":[{"package":{"name":"nodejs","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/nodejs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-2.module+el9.9.0+25297+fc0af076"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}},{"package":{"name":"nodejs-debuginfo","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/nodejs-debuginfo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-2.module+el9.9.0+25297+fc0af076"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}},{"package":{"name":"nodejs-debugsource","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/nodejs-debugsource"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-2.module+el9.9.0+25297+fc0af076"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}},{"package":{"name":"nodejs-devel","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/nodejs-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-2.module+el9.9.0+25297+fc0af076"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}},{"package":{"name":"nodejs-docs","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/nodejs-docs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-2.module+el9.9.0+25297+fc0af076"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}},{"package":{"name":"nodejs-full-i18n","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/nodejs-full-i18n"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-2.module+el9.9.0+25297+fc0af076"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}},{"package":{"name":"nodejs-libs","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/nodejs-libs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-2.module+el9.9.0+25297+fc0af076"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}},{"package":{"name":"nodejs-libs-debuginfo","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/nodejs-libs-debuginfo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-2.module+el9.9.0+25297+fc0af076"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}},{"package":{"name":"nodejs-nodemon","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/nodejs-nodemon"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.14-2.module+el9.9.0+25283+460aabd3"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}},{"package":{"name":"nodejs-packaging","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/nodejs-packaging"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.9.0+24923+ac50c00f"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}},{"package":{"name":"nodejs-packaging-bundler","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/nodejs-packaging-bundler"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-6.module+el9.9.0+24923+ac50c00f"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}},{"package":{"name":"npm","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.20.0-1.26.12.1.2.module+el9.9.0+25297+fc0af076"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}},{"package":{"name":"v8-14.6-devel","ecosystem":"Red Hat:enterprise_linux:9::appstream","purl":"pkg:rpm/redhat/v8-14.6-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:14.6.202.34-1.26.12.1.2.module+el9.9.0+25297+fc0af076"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98522.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}