RHSA-2026:98619 - Security Advisory

Topic

An update for nodejs26 is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

• nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation (CVE-2026-48617)
• nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance (CVE-2026-48931)
• nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
• nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
• nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
• nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
• nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
• Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
• nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
• nodejs: Node.js: Local server can be started without network permission via Permission API flaw (CVE-2026-48936)
• nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)
• undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697)
• nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
• nodejs: HTTPS Agent TLS session reuse skips hostname verification (CVE-2026-58040)
• nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions (CVE-2026-56847)
• nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw (CVE-2026-56850)
• nodejs: Information disclosure due to improper permission enforcement (CVE-2026-58039)
• nodejs: Node.js: Request smuggling via HTTP client header truncation (CVE-2026-58044)
• nodejs: Node.js: Denial of Service via DNS responses with excessive A records (CVE-2026-58042)
• nodejs: Node.js: Denial of Service vulnerability (CVE-2026-58045)
• nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator (CVE-2026-58041)
• nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)
• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
• undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)
• undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)
• undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)
• undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)
• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

Bug Fix(es) and Enhancement(s):

• nodejs26: Rebase to the latest Node.js 26 release [rhel-10.3.z] (JIRA:RHEL-295502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 10 x86_64
• Red Hat Enterprise Linux for IBM z Systems 10 s390x
• Red Hat Enterprise Linux for Power, little endian 10 ppc64le
• Red Hat Enterprise Linux for ARM 64 10 aarch64

Fixes

• BZ - 2490521 - CVE-2026-48617 nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation
• BZ - 2491494 - CVE-2026-48931 nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance
• BZ - 2493325 - CVE-2026-48619 nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames
• BZ - 2493326 - CVE-2026-48930 nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling
• BZ - 2493329 - CVE-2026-48935 nodejs: Node.js: Unauthorized file metadata modification
• BZ - 2493331 - CVE-2026-48933 nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt()
• BZ - 2493332 - CVE-2026-48934 nodejs: Node.js: Certification validation bypass in TLS host verification
• BZ - 2493333 - CVE-2026-48928 Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency
• BZ - 2493335 - CVE-2026-48615 nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling
• BZ - 2493336 - CVE-2026-48936 nodejs: Node.js: Local server can be started without network permission via Permission API flaw
• BZ - 2493337 - CVE-2026-48618 nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch
• BZ - 2508485 - CVE-2026-13697 undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives
• BZ - 2509171 - CVE-2026-58043 nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw
• BZ - 2509175 - CVE-2026-58040 nodejs: HTTPS Agent TLS session reuse skips hostname verification
• BZ - 2509178 - CVE-2026-56847 nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions
• BZ - 2509179 - CVE-2026-56850 nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw
• BZ - 2509653 - CVE-2026-58039 nodejs: Information disclosure due to improper permission enforcement
• BZ - 2510853 - CVE-2026-58044 nodejs: Node.js: Request smuggling via HTTP client header truncation
• BZ - 2510854 - CVE-2026-58042 nodejs: Node.js: Denial of Service via DNS responses with excessive A records
• BZ - 2510857 - CVE-2026-58045 nodejs: Node.js: Denial of Service vulnerability
• BZ - 2510858 - CVE-2026-58041 nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator
• BZ - 2511089 - CVE-2026-56848 nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service
• BZ - 2542700 - CVE-2026-102278 brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns
• BZ - 2542707 - CVE-2026-102276 brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns
• BZ - 2553656 - CVE-2026-109869 undici: undici: Denial of Service via unhandled stream error on excessive content encodings
• BZ - 2553677 - CVE-2026-87018 undici: undici: Denial of Service via TLS renegotiation with mismatched certificate
• BZ - 2553678 - CVE-2026-109383 undici: undici: Certificate validation bypass via dropped TLS options in Agent
• BZ - 2553679 - CVE-2026-109829 undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching
• BZ - 2559870 - CVE-2026-105483 nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames
• BZ - 2559873 - CVE-2026-106069 nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames
• BZ - 2559875 - CVE-2026-105482 nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character

CVEs

• CVE-2026-13697
• CVE-2026-48615
• CVE-2026-48617
• CVE-2026-48618
• CVE-2026-48619
• CVE-2026-48928
• CVE-2026-48930
• CVE-2026-48931
• CVE-2026-48933
• CVE-2026-48934
• CVE-2026-48935
• CVE-2026-48936
• CVE-2026-56847
• CVE-2026-56848
• CVE-2026-56850
• CVE-2026-58039
• CVE-2026-58040
• CVE-2026-58041
• CVE-2026-58042
• CVE-2026-58043
• CVE-2026-58044
• CVE-2026-58045
• CVE-2026-87018
• CVE-2026-102276
• CVE-2026-102278
• CVE-2026-105482
• CVE-2026-105483
• CVE-2026-106069
• CVE-2026-109383
• CVE-2026-109829
• CVE-2026-109869

References

• https://access.redhat.com/security/updates/classification/#important