RHSA-2026:92376
Vulnerability from csaf_redhat - Published: 2026-10-29 14:26 - Updated: 2026-10-30 13:25Summary
Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update
Severity
Important
Notes
Topic: An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
Bug Fix(es) and Enhancement(s):
* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the ip-address library. A remote attacker can exploit this vulnerability by supplying an excessively large IPv6 address string to an application that parses input without length limits. The parser attempts to process the unbounded input and generate disproportionately large error diagnostics, leading to excessive memory consumption. This issue can lead to a Denial of Service (DoS) by causing the application process to stall or crash.
5.3 (Medium)
Affected products
Fixed
40 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
40 products, the same list as for
CVE-2026-101911
Threats
Impact
Important
A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying specially crafted string patterns with repeated closing braces. Processing these malformed patterns causes the string expansion logic to repeatedly rescan the entire input, leading to excessive processor and memory consumption that can temporarily block the application event loop.
5.3 (Medium)
Affected products
Fixed
40 products, the same list as for
CVE-2026-101911
Threats
Impact
Moderate
A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.
6.5 (Medium)
Affected products
Fixed
40 products, the same list as for
CVE-2026-101911
Threats
Impact
Important
A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response is already buffered when the socket is assigned to a new request—for example because the event loop was busy with synchronous work—the guard is cleared without observing the data and the bytes are parsed as the response to the new request. This is an incomplete fix of CVE-2026-48931. A malicious or compromised peer that can write an early response on a reused connection may cause the client to accept unintended response content, affecting integrity and potentially confidentiality of application data.
6.5 (Medium)
Affected products
Fixed
40 products, the same list as for
CVE-2026-101911
Threats
Impact
Moderate
A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname.
7.4 (High)
Affected products
Fixed
40 products, the same list as for
CVE-2026-101911
Threats
Impact
Important
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence the connection target to impersonate a TLS server.
7.4 (High)
Affected products
Fixed
40 products, the same list as for
CVE-2026-101911
Threats
Impact
Important
A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not identify the peer that was actually connected, allowing server impersonation.
7.4 (High)
Affected products
Fixed
40 products, the same list as for
CVE-2026-101911
Threats
Impact
Important
A flaw was found in the Node.js Permission Model. Wildcard --allow-fs-read or --allow-fs-write rules can grant access to paths that do not match the intended wildcard when the requested path is shorter than the wildcard prefix and the radix-tree lookup stops comparing early. For example, --allow-fs-read=/etc/passwd.* may also allow reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree (for example when it is the only grant for that scope). This is a different root cause from CVE-2026-58043 and affects the Node.js 26.x line.
CWE-284 - Improper Access ControlAffected products
Fixed
40 products, the same list as for
CVE-2026-101911
Threats
Impact
Low
A flaw was found in Node.js TLS hostname verification. When a client connects using a non-canonical IPv4 hostname spelling (for example 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1), tls.checkServerIdentity() may fail to classify the host as an IP address, normalize it to a canonical form, and match that form against certificate DNS SANs instead of requiring an IP Address SAN. A certificate that contains a DNS SAN equal to the canonical IP string (for example DNS:127.0.0.1) without a corresponding IP Address SAN can therefore be accepted for an IP endpoint. Exploitation requires a certificate with such a numeric DNS SAN that is trusted by the client, and a platform resolver that accepts the non-canonical spelling (glibc does).
6.7 (Medium)
Affected products
Fixed
40 products, the same list as for
CVE-2026-101911
Threats
Impact
Moderate
A flaw was found in the Node.js Permission Model. fs.realpathSync() does not perform the filesystem read permission checks required of comparable fs APIs. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native(). Code running under --permission with restricted --allow-fs-read can still use fs.realpathSync() to probe file existence, resolve symlink targets, and enumerate paths outside permitted directories, leading to information disclosure.
CWE-425 - Direct Request ('Forced Browsing')Affected products
Fixed
40 products, the same list as for
CVE-2026-101911
Threats
Impact
Low
A flaw was found in Node.js crypto. Internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() can be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot. If those APIs (or dependents such as URL.createObjectURL()) run while the snapshot is built, every process started from that snapshot can replay the same initial values until the cache is refilled (on the order of 127 UUIDs and about 1,000 randomInt values). Identifiers expected to be unique may collide across processes, and values from one process may be predictable to an observer of another process started from the same snapshot.
4.8 (Medium)
Affected products
Fixed
40 products, the same list as for
CVE-2026-101911
Threats
Impact
Moderate
A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or potentially arbitrary code execution.
8.1 (High)
Affected products
Fixed
40 products, the same list as for
CVE-2026-101911
Threats
Exploit Status
CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Impact
Important
References
93 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n\n* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\n* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)\n\n* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)\n\n* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)\n\n* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)\n\n* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:92376",
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2542596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542596"
},
{
"category": "external",
"summary": "2542700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542700"
},
{
"category": "external",
"summary": "2542706",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542706"
},
{
"category": "external",
"summary": "2542707",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542707"
},
{
"category": "external",
"summary": "2558973",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558973"
},
{
"category": "external",
"summary": "2559870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559870"
},
{
"category": "external",
"summary": "2559873",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559873"
},
{
"category": "external",
"summary": "2559875",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559875"
},
{
"category": "external",
"summary": "2560016",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560016"
},
{
"category": "external",
"summary": "2560018",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560018"
},
{
"category": "external",
"summary": "2560019",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560019"
},
{
"category": "external",
"summary": "2560021",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560021"
},
{
"category": "external",
"summary": "2560022",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560022"
},
{
"category": "external",
"summary": "RHEL-289763",
"url": "https://issues.redhat.com/browse/RHEL-289763"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92376.json"
}
],
"title": "Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-10-30T13:25:59+00:00",
"generator": {
"date": "2026-10-30T13:25:59+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:92376",
"initial_release_date": "2026-10-29T14:26:32+00:00",
"revision_history": [
{
"date": "2026-10-29T14:26:32+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-29T14:26:32+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-30T13:25:59+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"product": {
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src (nodejs:24)",
"product_id": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=src\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"product": {
"name": "nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src (nodejs:24)",
"product_id": "nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-nodemon@3.1.14-2.module%2Bel8.10.0%2B24711%2Bb610b202?arch=src\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"product": {
"name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src (nodejs:24)",
"product_id": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-6.module%2Bel8.10.0%2B24711%2Bb610b202?arch=src\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"product": {
"name": "nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch (nodejs:24)",
"product_id": "nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-docs@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"product": {
"name": "nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch (nodejs:24)",
"product_id": "nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-nodemon@3.1.14-2.module%2Bel8.10.0%2B24711%2Bb610b202?arch=noarch\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"product": {
"name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch (nodejs:24)",
"product_id": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-packaging@2021.06-6.module%2Bel8.10.0%2B24711%2Bb610b202?arch=noarch\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"product": {
"name": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch (nodejs:24)",
"product_id": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-packaging-bundler@2021.06-6.module%2Bel8.10.0%2B24711%2Bb610b202?arch=noarch\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"product": {
"name": "npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch (nodejs:24)",
"product_id": "npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/npm@11.19.1-1.24.22.1.1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=noarch\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product": {
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24)",
"product_id": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product": {
"name": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24)",
"product_id": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debuginfo@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product": {
"name": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24)",
"product_id": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debugsource@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product": {
"name": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24)",
"product_id": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-devel@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product": {
"name": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24)",
"product_id": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-full-i18n@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product": {
"name": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24)",
"product_id": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product": {
"name": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24)",
"product_id": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=aarch64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24)",
"product_id": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v8-13.6-devel@13.6.233.17-1.24.22.1.1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=aarch64\u0026epoch=3\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product": {
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24)",
"product_id": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product": {
"name": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24)",
"product_id": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debuginfo@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product": {
"name": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24)",
"product_id": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debugsource@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product": {
"name": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24)",
"product_id": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-devel@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product": {
"name": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24)",
"product_id": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-full-i18n@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product": {
"name": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24)",
"product_id": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product": {
"name": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24)",
"product_id": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=ppc64le\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24)",
"product_id": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v8-13.6-devel@13.6.233.17-1.24.22.1.1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=ppc64le\u0026epoch=3\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product": {
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24)",
"product_id": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product": {
"name": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24)",
"product_id": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debuginfo@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product": {
"name": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24)",
"product_id": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debugsource@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product": {
"name": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24)",
"product_id": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-devel@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product": {
"name": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24)",
"product_id": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-full-i18n@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product": {
"name": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24)",
"product_id": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product": {
"name": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24)",
"product_id": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=s390x\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24)",
"product_id": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v8-13.6-devel@13.6.233.17-1.24.22.1.1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=s390x\u0026epoch=3\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product": {
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24)",
"product_id": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product": {
"name": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24)",
"product_id": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debuginfo@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product": {
"name": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24)",
"product_id": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-debugsource@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product": {
"name": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24)",
"product_id": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-devel@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product": {
"name": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24)",
"product_id": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-full-i18n@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product": {
"name": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24)",
"product_id": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product": {
"name": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24)",
"product_id": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs-libs-debuginfo@24.22.1-1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=x86_64\u0026epoch=1\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
},
{
"category": "product_version",
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24)",
"product_id": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/v8-13.6-devel@13.6.233.17-1.24.22.1.1.module%2Bel8.10.0%2B25218%2Bd9e131cb?arch=x86_64\u0026epoch=3\u0026rpmmod=nodejs:24:8100020261027151919:6d880403"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24"
},
"product_reference": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24"
},
"product_reference": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24"
},
"product_reference": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24"
},
"product_reference": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
},
"product_reference": "nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24"
},
"product_reference": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24"
},
"product_reference": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24"
},
"product_reference": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
},
"product_reference": "nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24"
},
"product_reference": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24"
},
"product_reference": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24"
},
"product_reference": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
},
"product_reference": "nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24"
},
"product_reference": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24"
},
"product_reference": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24"
},
"product_reference": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
},
"product_reference": "nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24"
},
"product_reference": "nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24"
},
"product_reference": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24"
},
"product_reference": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24"
},
"product_reference": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
},
"product_reference": "nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24"
},
"product_reference": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24"
},
"product_reference": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24"
},
"product_reference": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
},
"product_reference": "nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24"
},
"product_reference": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24"
},
"product_reference": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24"
},
"product_reference": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
},
"product_reference": "nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24"
},
"product_reference": "nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24"
},
"product_reference": "nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24"
},
"product_reference": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24"
},
"product_reference": "nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24"
},
"product_reference": "nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24"
},
"product_reference": "npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24"
},
"product_reference": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24"
},
"product_reference": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24"
},
"product_reference": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64 (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
},
"product_reference": "v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-101911",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-28T18:01:43.569419+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542596"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the ip-address library. A remote attacker can exploit this vulnerability by supplying an excessively large IPv6 address string to an application that parses input without length limits. The parser attempts to process the unbounded input and generate disproportionately large error diagnostics, leading to excessive memory consumption. This issue can lead to a Denial of Service (DoS) by causing the application process to stall or crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is assessed as Moderate severity because triggering service disruption requires applications to accept multi-megabyte network inputs into the address parser without front-end length restrictions. In typical Red Hat environments and standard HTTP deployments, web servers, reverse proxies, and request parsers enforce strict request size and header boundaries by default, which significantly limits the blast radius. Consequently, while malformed inputs may induce brief event-loop stalls or transient memory spikes, triggering an unhandled process termination necessitates an exceptionally large payload that is rejected under standard production configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-101911"
},
{
"category": "external",
"summary": "RHBZ#2542596",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542596"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-101911",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-101911"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-101911",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101911"
},
{
"category": "external",
"summary": "https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134",
"url": "https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134"
},
{
"category": "external",
"summary": "https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5",
"url": "https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5"
},
{
"category": "external",
"summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1",
"url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"
},
{
"category": "external",
"summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw",
"url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw"
}
],
"release_date": "2026-09-28T17:46:52.711000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing"
},
{
"cve": "CVE-2026-102276",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-28T21:02:20.910434+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542707"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this vulnerability as Important because an unauthenticated remote attacker can crash running Node.js services by submitting malformed pattern strings, resulting in a denial of service. In Red Hat environments, applications that accept arbitrary glob or expansion patterns from external inputs are susceptible to unexpected termination due to an unhandled call stack overflow. While this flaw allows service interruption without requiring privileges, it does not lead to code execution or compromise data confidentiality and integrity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102276"
},
{
"category": "external",
"summary": "RHBZ#2542707",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542707"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102276"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102276"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"
}
],
"release_date": "2026-09-28T20:50:59.984000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns"
},
{
"cve": "CVE-2026-102277",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-09-28T21:02:04.232957+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542706"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying specially crafted string patterns with repeated closing braces. Processing these malformed patterns causes the string expansion logic to repeatedly rescan the entire input, leading to excessive processor and memory consumption that can temporarily block the application event loop.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: brace-expansion: Denial of Service via crafted brace patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A moderate-impact denial of service vulnerability was found in brace-expansion, an npm package bundled as a dependency in a large number of Red Hat products that ship Node.js-based components. When an application passes attacker-controlled input to the expand function, a remote unauthenticated attacker can supply a crafted `{a},b}`-shaped pattern containing many trailing closing braces. The parser rewrites the string and restarts its scan once for each trailing closing brace, and every pass rescans the entire input, resulting in quadratic CPU time and memory consumption. This can block the Node.js event loop of the affected process and temporarily disrupt application availability; the process recovers once the expansion completes, making this a recoverable CPU denial of service with no impact on confidentiality or integrity. The large majority of Red Hat product streams that ship a bundled copy of brace-expansion are affected; a small number of shipped components are marked not affected because the vulnerable code is not present in the shipped version or because those components do not include brace-expansion. For most affected streams the fix is deferred to a routine future component update, since the flaw is a recoverable, availability-only denial of service of low severity; the residual risk of deferral is temporary CPU and memory pressure and event-loop blocking when an attacker is able to supply crafted brace patterns to an affected application\u0027s expansion call. For streams where remediation is delegated, the maintainers of the bundled component are pursuing a fix, and a small number of streams have already shipped an update that remediates the issue. The Red Hat severity of MODERATE (CVSS 3.1 score 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) is consistent with the upstream assessment, so there is no meaningful difference from upstream severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102277"
},
{
"category": "external",
"summary": "RHBZ#2542706",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542706"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102277"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96",
"url": "https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22",
"url": "https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364",
"url": "https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e",
"url": "https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr",
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"
}
],
"release_date": "2026-09-28T20:54:46.160000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating the bundled brace-expansion dependency to a version that contains the upstream fix (1.1.21, 2.1.7, 3.0.9, or 5.0.12, depending on the major version in use) resolves the issue.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "brace-expansion: brace-expansion: Denial of Service via crafted brace patterns"
},
{
"cve": "CVE-2026-102278",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-28T21:00:55.949756+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2542700"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because remote unauthenticated attackers can supply crafted nested expressions to trigger native stack exhaustion and crash server-side processes, resulting in a denial of service without compromising system confidentiality or integrity. In Red Hat environments, the affected library is distributed across containerized web consoles, developer tools, and Node.js runtime environments. Exploitation is constrained to deployments where applications process untrusted, user-defined pattern inputs directly through expansion functions without input depth validation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-102278"
},
{
"category": "external",
"summary": "RHBZ#2542700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542700"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-102278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-102278"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102278"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"
}
],
"release_date": "2026-09-28T20:57:09.850000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns"
},
{
"cve": "CVE-2026-105481",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-10-23T16:21:49.964136+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2560019"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response is already buffered when the socket is assigned to a new request\u2014for example because the event loop was busy with synchronous work\u2014the guard is cleared without observing the data and the bytes are parsed as the response to the new request. This is an incomplete fix of CVE-2026-48931. A malicious or compromised peer that can write an early response on a reused connection may cause the client to accept unintended response content, affecting integrity and potentially confidentiality of application data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a Moderate severity flaw. Red Hat rates it Moderate because successful exploitation requires a reused HTTP keep-alive connection, an unsolicited response already present on the socket, and timing such that the idle-socket guard does not observe that data before the next request (high attack complexity). When those conditions hold, the client can attribute attacker-controlled response content to a subsequent request (integrity High, confidentiality Low). Platform memory and isolation safeguards (ASLR, NX, SELinux, FORTIFY_SOURCE) do not mitigate this logic-level response mix-up and do not change the base score. The issue does not provide remote code execution by itself.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-105481"
},
{
"category": "external",
"summary": "RHBZ#2560019",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560019"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-105481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-105481"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-105481",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105481"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
}
],
"release_date": "2026-10-23T16:15:05.837000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "Restrict Node.js clients so outbound HTTP/1.1 keep-alive pools only reach trusted backends.\nWhere operationally feasible, disable connection reuse to untrusted hosts (for example short-lived agents or agents with keepAlive disabled).\nPrefer authenticated TLS backends and avoid sending security-sensitive requests over keep-alive pools shared with untrusted peers.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse"
},
{
"acknowledgments": [
{
"names": [
"Hasan Flayyih Abdullah"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-105482",
"cwe": {
"id": "CWE-158",
"name": "Improper Neutralization of Null Byte or NUL Character"
},
"discovery_date": "2026-10-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2559875"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important. Exploitation requires that the application resolve an attacker-influenced hostname containing an embedded NUL via dns.resolve (callback or promise APIs). Attack Complexity is High because the NUL-bearing name must reach those APIs and the application must rely on the returned records (for example to open a subsequent connection). Successful abuse can redirect trust in name resolution and lead to confidentiality and integrity impact comparable to connecting to the wrong host; Availability is not directly affected. Upstream rates this High and fixed it in Node.js 22.23.4, 24.22.1, and 26.12.1.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-105482"
},
{
"category": "external",
"summary": "RHBZ#2559875",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559875"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-105482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-105482"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-105482",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105482"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/release/v22.23.4",
"url": "https://nodejs.org/en/blog/release/v22.23.4"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "To mitigate, do not pass untrusted strings into dns.resolve; reject hostnames that contain embedded NUL bytes before DNS resolution. Limit which components may perform DNS lookups on attacker-influenced names, and restrict network reachability of those services.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character"
},
{
"acknowledgments": [
{
"names": [
"Hasan Flayyih Abdullah"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-105483",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2026-10-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2559870"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence the connection target to impersonate a TLS server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important. Exploitation requires a Node.js TLS client to connect using a hostname that contains fullwidth Unicode digits which normalize to an IPv4 address, together with a certificate that satisfies the incorrect matching behavior. Attack Complexity is High because the attacker must influence the host string used for the connection (for example a user-supplied URL) and present a suitable certificate, typically with a privileged network position relative to that connection. Confidentiality and Integrity are High because a successful bypass enables server impersonation and exposure or alteration of TLS application data; Availability is not affected. This flaw affects Node.js 24.x and 26.x lines and does not affect the 22.x line per the upstream advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-105483"
},
{
"category": "external",
"summary": "RHBZ#2559870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559870"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-105483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-105483"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-105483",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105483"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/release/v24.22.1",
"url": "https://nodejs.org/en/blog/release/v24.22.1"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "To mitigate do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits into TLS clients such as tls.connect, https.request, or fetch. Restrict outbound TLS connections to trusted destinations only, and segment services that initiate TLS client connections from untrusted networks.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames"
},
{
"acknowledgments": [
{
"names": [
"anagnorisis2peripeteia"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-106069",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2026-10-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2559873"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not identify the peer that was actually connected, allowing server impersonation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important. Exploitation requires a Node.js TLS client to connect using a non-canonical numeric hostname that normalizes to an IP address for certificate matching while name resolution uses a different interpretation, and a certificate that includes an IP subjectAltName matching the normalized address. Attack Complexity is High due to these prerequisites and the need to influence the connection target or traffic. Confidentiality and Integrity are High for a successful impersonation of a TLS peer; Availability is not affected. Upstream rates this High and fixed it in Node.js 22.23.4, 24.22.1, and 26.12.1.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-106069"
},
{
"category": "external",
"summary": "RHBZ#2559873",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559873"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-106069",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106069"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106069",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106069"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/release/v22.23.4",
"url": "https://nodejs.org/en/blog/release/v22.23.4"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames"
},
{
"cve": "CVE-2026-106071",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"discovery_date": "2026-10-23T16:21:44.365586+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2560018"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Node.js Permission Model. Wildcard --allow-fs-read or --allow-fs-write rules can grant access to paths that do not match the intended wildcard when the requested path is shorter than the wildcard prefix and the radix-tree lookup stops comparing early. For example, --allow-fs-read=/etc/passwd.* may also allow reading /etc/passwd. This requires the wildcard grant to sit directly under the root of the permission tree (for example when it is the only grant for that scope). This is a different root cause from CVE-2026-58043 and affects the Node.js 26.x line.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: nodejs: Permission model bypass via wildcard path matching flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a Low severity flaw. Red Hat rates it Low because the Permission Model is an opt-in experimental hardening feature (--permission), exploitation needs a specific wildcard grant layout (high attack complexity), and impact is limited to additional filesystem read/write within that model (Low/Low). Deployments that do not enable --permission are not exposed. The issue is confined to Node.js 26.x.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-106071"
},
{
"category": "external",
"summary": "RHBZ#2560018",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560018"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-106071",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106071"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106071",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106071"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
}
],
"release_date": "2026-10-23T16:15:05.791000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "If the Permission Model is unused, do not enable --permission.\nWhen using --allow-fs-read/--allow-fs-write, avoid wildcard grants placed as the sole root-level rule; prefer explicit directory prefixes without ambiguous wildcards.\nCombine application allowlists with OS confinement such as SELinux or container filesystem restrictions .",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs: nodejs: Permission model bypass via wildcard path matching flaw"
},
{
"cve": "CVE-2026-106072",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-23T16:22:40.316669+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2560022"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Node.js TLS hostname verification. When a client connects using a non-canonical IPv4 hostname spelling (for example 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1), tls.checkServerIdentity() may fail to classify the host as an IP address, normalize it to a canonical form, and match that form against certificate DNS SANs instead of requiring an IP Address SAN. A certificate that contains a DNS SAN equal to the canonical IP string (for example DNS:127.0.0.1) without a corresponding IP Address SAN can therefore be accepted for an IP endpoint. Exploitation requires a certificate with such a numeric DNS SAN that is trusted by the client, and a platform resolver that accepts the non-canonical spelling (glibc does).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a Moderate severity flaw, matching the upstream Node.js Medium rating. Red Hat aligns with the CNA CVSS (6.7): exploitation requires both a non-canonical IPv4 host form and a certificate with a DNS SAN for the canonical IP string that is already trusted by the client (Privileges Required: High relative to a generic network attacker without such a cert). On Red Hat platforms using glibc, the resolver accepts these spellings, so that part of the prerequisite is met. Successful abuse can confuse TLS endpoint identity with high confidentiality and integrity impact for the affected connection, but the trusted-cert barrier keeps the overall rating Moderate rather than Important.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-106072"
},
{
"category": "external",
"summary": "RHBZ#2560022",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560022"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-106072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106072"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
}
],
"release_date": "2026-10-23T16:15:05.783000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "Use only canonical IPv4 literals or DNS names in Node.js TLS client connect targets; reject octal, hex, dword, and shortened IPv4 spellings in application input.\nWhere feasible, pin expected server certificates or public keys for sensitive outbound TLS.\nRestrict which destinations Node.js workloads may reach with egress controls.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification"
},
{
"cve": "CVE-2026-106073",
"cwe": {
"id": "CWE-425",
"name": "Direct Request (\u0027Forced Browsing\u0027)"
},
"discovery_date": "2026-10-23T16:22:29.439737+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2560021"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Node.js Permission Model. fs.realpathSync() does not perform the filesystem read permission checks required of comparable fs APIs. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native(). Code running under --permission with restricted --allow-fs-read can still use fs.realpathSync() to probe file existence, resolve symlink targets, and enumerate paths outside permitted directories, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a Low severity flaw. Red Hat rates it Low, consistent with CVE-2026-21715, because impact is limited to confidentiality of path existence and symlink resolution (Confidentiality Low), and the Permission Model is an opt-in experimental control. Integrity and availability are not affected. Deployments that do not use --permission are not exposed. Platform MAC (SELinux) may still constrain process file access outside the Permission Model but is not assumed to replace Node.js checks in the base score.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-106073"
},
{
"category": "external",
"summary": "RHBZ#2560021",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560021"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-106073",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106073"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106073",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106073"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
}
],
"release_date": "2026-10-23T16:15:05.728000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "If the Permission Model is unused, do not enable --permission.\nWhen --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal.\nApply OS-level confinement (SELinux, containers) as defense in depth.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()"
},
{
"cve": "CVE-2026-106074",
"cwe": {
"id": "CWE-335",
"name": "Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2026-10-23T16:21:20.980173+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2560016"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Node.js crypto. Internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() can be saved into user-land startup snapshots (--build-snapshot) and single executable applications built with useSnapshot. If those APIs (or dependents such as URL.createObjectURL()) run while the snapshot is built, every process started from that snapshot can replay the same initial values until the cache is refilled (on the order of 127 UUIDs and about 1,000 randomInt values). Identifiers expected to be unique may collide across processes, and values from one process may be predictable to an observer of another process started from the same snapshot.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a Moderate severity flaw. Red Hat rates it Moderate because impact is limited to confidentiality and integrity of early pseudo-random values (Low/Low) and exploitation requires building or distributing a startup snapshot or SEA with useSnapshot after exercising the affected APIs (high attack complexity; non-default deployment pattern). Typical Red Hat Node.js RPM and service deployments that do not ship custom snapshots are less exposed in practice, but the vulnerable code is present in affected Node.js streams. OS-level hardening does not reset Node/V8 entropy caches across snapshot restore.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-106074"
},
{
"category": "external",
"summary": "RHBZ#2560016",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560016"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-106074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-106074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-106074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106074"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
}
],
"release_date": "2026-10-23T16:15:05.829000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "Do not ship or run user-land snapshots or SEAs built with useSnapshot if crypto.randomUUID/randomInt (or APIs that use them) executed during snapshot creation.\nPrefer generating security-sensitive nonces and identifiers after process start, outside snapshot initialization.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nodejs: nodejs: predictable random values via snapshot entropy cache reuse"
},
{
"cve": "CVE-2026-111497",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-22T13:42:58.596140+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2558973"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or potentially arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important. Exploitation requires that the target decompress attacker-controlled Brotli data (for example HTTP content negotiated with Content-Encoding: br, or APIs such as Node.js zlib / fetch() that decode Brotli). The vulnerable path is reached with a malformed stream rather than typical well-formed encoder output, and there is no public, reliable remote code execution proof-of-concept. Red Hat Enterprise Linux compiler and runtime hardenings - including Address Space Layout Randomization (ASLR), Non-eXecutable (NX) memory, FORTIFY_SOURCE, and SELinux - increase the difficulty of turning this memory corruption into reliable code execution, though they do not eliminate crashes or all impact. Combined with the Attack Requirements noted by the CNA (CVSS v4 AT:P), Red Hat scores Attack Complexity as High and rates the flaw Important rather than Critical.\n\n---\n\nThe Node.js packages in Red Hat Enterprise Linux use either system version of brotli or bundled version. Some Node.js versions are marked \"Not affected\" because they utilize system brotli. For these versions, the Node.js package itself does not require updating. However, customers must still update the system brotli/libbrotli package to address the vulnerability for these Node.js installations.\n\nFollowing is the overview of Node.js versions use system or bundled version.\n\n- Node.js 22 in Red Hat Enterprise Linux 8 and 9, provided via nodejs:22 module, uses system brotli.\n- Node.js 24 in Red Hat Enterprise Linux 8 and 9, provided via nodejs:24 modules, use bundled brotli.\n- Node.js 22 and 24 in Red Hat Enterprise Linux 10, provided via nodejs22 and nodejs24 use system brotli.\n\n---\n\nThe .NET packages in Red Hat Enterprise Linux may either use system version of brotli or bundled version. Following is the overview of .NET versions use system or bundled version.\n\n- .NET 8.0 in Red Hat Enterprise Linux 8, 9, and 10, provided via dotnet8.0 packages, use bundled brotli.\n- .NET 9.0, 10.0, and 11.0 in Red Hat Enterprise Linux 8, 9, and 10, provided via dotnet9.0, dotnet10.0, and dotnet11.0 packages, use system brotli.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111497"
},
{
"category": "external",
"summary": "RHBZ#2558973",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558973"
},
{
"category": "external",
"summary": "RHSB-2026-015",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111497"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2026-10-22T13:35:41.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-29T14:26:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:92376"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-debugsource-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-devel-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-docs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-full-i18n-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-libs-debuginfo-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-nodemon-0:3.1.14-2.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-0:2021.06-6.module+el8.10.0+24711+b610b202.src::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:nodejs-packaging-bundler-0:2021.06-6.module+el8.10.0+24711+b610b202.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:npm-1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.noarch::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24",
"AppStream-8.10.0.Z.MAIN.EUS:v8-13.6-devel-3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb.x86_64::nodejs:24"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2026-10-27T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Important"
}
],
"title": "brotli: Out-of-Bounds Write in Google Brotli Decoder"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.