{"id":"RLSA-2026:35842","summary":"Important: nodejs22 security, bug fix, and enhancement update","details":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)\n\n* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)\n\n* undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)\n\n* undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)\n\n* undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)\n\n* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)\n\n* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)\n\n* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)\n\n* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)\n\n* nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)\n\n* Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)\n\n* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)\n\n* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs22: Rebase to the latest Node.js 22 release [rhel-10.2.z] (JIRA:Rocky Linux-186623)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","modified":"2026-07-08T12:30:05.898743217Z","published":"2026-07-08T12:06:21.540749Z","upstream":["CVE-2026-11525","CVE-2026-12151","CVE-2026-42338","CVE-2026-48615","CVE-2026-48618","CVE-2026-48619","CVE-2026-48928","CVE-2026-48930","CVE-2026-48933","CVE-2026-48934","CVE-2026-48935","CVE-2026-6733","CVE-2026-9678"],"references":[{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:35842"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490006"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476810"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490008"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493333"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493329"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493335"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493331"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489980"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493332"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490000"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493326"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493325"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493337"}],"affected":[{"package":{"name":"nodejs22","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/nodejs22?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.23.1-2.el10_2"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:35842.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"credits":[{"name":"Rocky Enterprise Software Foundation"},{"name":"Red Hat"}]}