{"id":"RLSA-2026:7675","summary":"Important: nodejs24 security update","details":"Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","modified":"2026-04-15T12:30:34.977687Z","published":"2026-04-15T12:07:10.074197Z","upstream":["CVE-2026-1525","CVE-2026-1526","CVE-2026-1527","CVE-2026-1528","CVE-2026-21637","CVE-2026-21710","CVE-2026-21711","CVE-2026-21712","CVE-2026-21713","CVE-2026-21714","CVE-2026-21715","CVE-2026-21716","CVE-2026-21717","CVE-2026-2229","CVE-2026-25547","CVE-2026-2581","CVE-2026-26996","CVE-2026-27135"],"references":[{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:7675"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453162"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447142"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453160"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447144"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447140"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453161"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436942"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453151"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453037"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447141"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453158"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453157"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453152"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441268"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448754"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447143"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431340"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447145"}],"affected":[{"package":{"name":"nodejs24","ecosystem":"Rocky Linux:10","purl":"pkg:rpm/rocky-linux/nodejs24?distro=rocky-linux-10&epoch=1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.14.1-2.el10_1"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:7675.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"credits":[{"name":"Rocky Enterprise Software Foundation"},{"name":"Red Hat"}]}