{"id":"RHSA-2026:98619","summary":"Red Hat Security Advisory: nodejs26 security, bug fix, and enhancement update","modified":"2026-11-14T13:00:46.026245391Z","published":"2026-11-13T18:51:25Z","withdrawn":"2026-11-14T13:00:46.026245183Z","upstream":["CVE-2026-102276","CVE-2026-102278","CVE-2026-105482","CVE-2026-105483","CVE-2026-106069","CVE-2026-109383","CVE-2026-109829","CVE-2026-109869","CVE-2026-13697","CVE-2026-48615","CVE-2026-48617","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48931","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-48936","CVE-2026-56847","CVE-2026-56848","CVE-2026-56850","CVE-2026-58039","CVE-2026-58040","CVE-2026-58041","CVE-2026-58042","CVE-2026-58043","CVE-2026-58044","CVE-2026-58045","CVE-2026-87018"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:98619"},{"type":"ARTICLE","url":"https://access.redhat.com/security/updates/classification/#important"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490521"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491494"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493325"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493326"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493329"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493331"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493332"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493333"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493335"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493336"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493337"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508485"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509171"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509175"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509178"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509179"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509653"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510853"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510854"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510857"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510858"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511089"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542700"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542707"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553656"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553677"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553678"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553679"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559870"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559873"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559875"},{"type":"ADVISORY","url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98619.json"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-13697"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-13697"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13697"},{"type":"ARTICLE","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-48615"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-48615"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48615"},{"type":"ARTICLE","url":"https://nodejs.org/en/blog/vulnerability/june-2026-security-releases"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-48617"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-48617"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48617"},{"type":"ARTICLE","url":"http://hackerone.com/reports/3692858"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-48618"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-48618"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48618"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-48619"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-48619"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48619"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-48928"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-48928"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48928"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-48930"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-48930"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48930"},{"type":"ARTICLE","url":"https://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e"},{"type":"ARTICLE","url":"https://hackerone.com/reports/3656716"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-48931"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-48931"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48931"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-48933"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-48933"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48933"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-48934"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-48934"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48934"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-48935"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-48935"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48935"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-48936"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-48936"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48936"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-56847"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-56847"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56847"},{"type":"ARTICLE","url":"https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-56848"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-56848"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56848"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-56850"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-56850"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56850"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-58039"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-58039"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58039"},{"type":"ARTICLE","url":"https://nodejs.org/en/blog/vulnerability"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-58040"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-58040"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58040"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-58041"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-58041"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58041"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-58042"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-58042"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58042"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-58043"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-58043"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58043"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-58044"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-58044"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58044"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-58045"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-58045"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58045"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-87018"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-87018"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87018"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-102276"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-102276"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-102278"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-102278"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"},{"type":"ARTICLE","url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-105482"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-105482"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105482"},{"type":"ARTICLE","url":"https://nodejs.org/en/blog/release/v22.23.4"},{"type":"ARTICLE","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-105483"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-105483"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105483"},{"type":"ARTICLE","url":"https://nodejs.org/en/blog/release/v24.22.1"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-106069"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-106069"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106069"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-109383"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-109383"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109383"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/commit/f75eac00ac17"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-109829"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-109829"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109829"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/commit/26c2bfb3def0"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-109869"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-109869"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/commit/b5084c7dc239"},{"type":"ARTICLE","url":"https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"}],"affected":[{"package":{"name":"nodejs26","ecosystem":"Red Hat:enterprise_linux:10.3","purl":"pkg:rpm/redhat/nodejs26"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-3.el10_3"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98619.json"}},{"package":{"name":"nodejs26-debuginfo","ecosystem":"Red Hat:enterprise_linux:10.3","purl":"pkg:rpm/redhat/nodejs26-debuginfo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-3.el10_3"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98619.json"}},{"package":{"name":"nodejs26-debugsource","ecosystem":"Red Hat:enterprise_linux:10.3","purl":"pkg:rpm/redhat/nodejs26-debugsource"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-3.el10_3"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98619.json"}},{"package":{"name":"nodejs26-devel","ecosystem":"Red Hat:enterprise_linux:10.3","purl":"pkg:rpm/redhat/nodejs26-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-3.el10_3"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98619.json"}},{"package":{"name":"nodejs26-docs","ecosystem":"Red Hat:enterprise_linux:10.3","purl":"pkg:rpm/redhat/nodejs26-docs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-3.el10_3"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98619.json"}},{"package":{"name":"nodejs26-full-i18n","ecosystem":"Red Hat:enterprise_linux:10.3","purl":"pkg:rpm/redhat/nodejs26-full-i18n"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-3.el10_3"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98619.json"}},{"package":{"name":"nodejs26-libs","ecosystem":"Red Hat:enterprise_linux:10.3","purl":"pkg:rpm/redhat/nodejs26-libs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-3.el10_3"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98619.json"}},{"package":{"name":"nodejs26-libs-debuginfo","ecosystem":"Red Hat:enterprise_linux:10.3","purl":"pkg:rpm/redhat/nodejs26-libs-debuginfo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:26.12.1-3.el10_3"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98619.json"}},{"package":{"name":"nodejs26-npm","ecosystem":"Red Hat:enterprise_linux:10.3","purl":"pkg:rpm/redhat/nodejs26-npm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.20.0-1.26.12.1.3.el10_3"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2026:98619.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}]}