RHSA-2026:97855 - Security Advisory

Topic

An update for the nodejs:26 module is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation (CVE-2026-48617)
• nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance (CVE-2026-48931)
• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
• nodejs: Node.js: Local server can be started without network permission via Permission API flaw (CVE-2026-48936)
• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)
• undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697)
• nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
• nodejs: HTTPS Agent TLS session reuse skips hostname verification (CVE-2026-58040)
• nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions (CVE-2026-56847)
• nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw (CVE-2026-56850)
• nodejs: Information disclosure due to improper permission enforcement (CVE-2026-58039)
• nodejs: Node.js: Request smuggling via HTTP client header truncation (CVE-2026-58044)
• nodejs: Node.js: Denial of Service via DNS responses with excessive A records (CVE-2026-58042)
• nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
• nodejs: Node.js: Denial of Service vulnerability (CVE-2026-58045)
• nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator (CVE-2026-58041)
• nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)
• undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
• undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
• undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

• BZ - 2490521 - CVE-2026-48617 nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation
• BZ - 2491494 - CVE-2026-48931 nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance
• BZ - 2493325 - CVE-2026-48619 nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames
• BZ - 2493326 - CVE-2026-48930 nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling
• BZ - 2493329 - CVE-2026-48935 nodejs: Node.js: Unauthorized file metadata modification
• BZ - 2493331 - CVE-2026-48933 nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()
• BZ - 2493332 - CVE-2026-48934 nodejs: Node.js: Certification validation bypass in TLS host verification
• BZ - 2493333 - CVE-2026-48928 Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency
• BZ - 2493335 - CVE-2026-48615 nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling
• BZ - 2493336 - CVE-2026-48936 nodejs: Node.js: Local server can be started without network permission via Permission API flaw
• BZ - 2493337 - CVE-2026-48618 nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch
• BZ - 2508485 - CVE-2026-13697 undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives
• BZ - 2509171 - CVE-2026-58043 nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw
• BZ - 2509175 - CVE-2026-58040 nodejs: HTTPS Agent TLS session reuse skips hostname verification
• BZ - 2509178 - CVE-2026-56847 nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions
• BZ - 2509179 - CVE-2026-56850 nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw
• BZ - 2509653 - CVE-2026-58039 nodejs: Information disclosure due to improper permission enforcement
• BZ - 2510853 - CVE-2026-58044 nodejs: Node.js: Request smuggling via HTTP client header truncation
• BZ - 2510854 - CVE-2026-58042 nodejs: Node.js: Denial of Service via DNS responses with excessive A records
• BZ - 2510856 - CVE-2026-56846 nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks
• BZ - 2510857 - CVE-2026-58045 nodejs: Node.js: Denial of Service vulnerability
• BZ - 2510858 - CVE-2026-58041 nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator
• BZ - 2511089 - CVE-2026-56848 nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service
• BZ - 2528717 - CVE-2026-85152 undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation
• BZ - 2528735 - CVE-2026-84961 undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options
• BZ - 2528759 - CVE-2026-19534 undici: undici: Denial of Service via unrequested WebSocket subprotocol

CVEs

• CVE-2026-13697
• CVE-2026-19534
• CVE-2026-48615
• CVE-2026-48617
• CVE-2026-48618
• CVE-2026-48619
• CVE-2026-48928
• CVE-2026-48930
• CVE-2026-48931
• CVE-2026-48933
• CVE-2026-48934
• CVE-2026-48935
• CVE-2026-48936
• CVE-2026-56846
• CVE-2026-56847
• CVE-2026-56848
• CVE-2026-56850
• CVE-2026-58039
• CVE-2026-58040
• CVE-2026-58041
• CVE-2026-58042
• CVE-2026-58043
• CVE-2026-58044
• CVE-2026-58045
• CVE-2026-84961
• CVE-2026-85152

References

• https://access.redhat.com/security/updates/classification/#important