{ "document" : { "aggregate_severity" : { "namespace" : "https://access.redhat.com/security/updates/classification/", "text" : "Important" }, "category" : "csaf_security_advisory", "csaf_version" : "2.0", "distribution" : { "text" : "Copyright © Red Hat, Inc. All rights reserved.", "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "en", "notes" : [ { "category" : "summary", "text" : "An update for nodejs22 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title" : "Topic" }, { "category" : "general", "text" : "Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)\n\n* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)\n\n* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)\n\n* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)\n\n* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)\n\n* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)\n\n* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)\n\n* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title" : "Details" }, { "category" : "legal_disclaimer", "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title" : "Terms of Use" } ], "publisher" : { "category" : "vendor", "contact_details" : "https://access.redhat.com/security/team/contact/", "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name" : "Red Hat Product Security", "namespace" : "https://www.redhat.com" }, "references" : [ { "category" : "self", "summary" : "https://access.redhat.com/errata/RHSA-2026:96094", "url" : "https://access.redhat.com/errata/RHSA-2026:96094" }, { "category" : "external", "summary" : "https://access.redhat.com/security/updates/classification/#important", "url" : "https://access.redhat.com/security/updates/classification/#important" }, { "category" : "external", "summary" : "2542700", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2542700" }, { "category" : "external", "summary" : "2542707", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2542707" }, { "category" : "external", "summary" : "2553656", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2553656" }, { "category" : "external", "summary" : "2553677", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2553677" }, { "category" : "external", "summary" : "2553678", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2553678" }, { "category" : "external", "summary" : "2553679", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2553679" }, { "category" : "external", "summary" : "2559873", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2559873" }, { "category" : "external", "summary" : "2559875", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2559875" }, { "category" : "self", "summary" : "Canonical URL", "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_96094.json" } ], "title" : "Red Hat Security Advisory: nodejs22 security update", "tracking" : { "current_release_date" : "2026-11-09T16:41:52+00:00", "generator" : { "date" : "2026-11-09T16:41:52+00:00", "engine" : { "name" : "Red Hat SDEngine", "version" : "5.4.5" } }, "id" : "RHSA-2026:96094", "initial_release_date" : "2026-11-09T03:57:18+00:00", "revision_history" : [ { "date" : "2026-11-09T03:57:18+00:00", "number" : "1", "summary" : "Initial version" }, { "date" : "2026-11-09T03:57:18+00:00", "number" : "2", "summary" : "Last updated version" }, { "date" : "2026-11-09T16:41:52+00:00", "number" : "3", "summary" : "Last generated version" } ], "status" : "final", "version" : "3" } }, "product_tree" : { "branches" : [ { "branches" : [ { "branches" : [ { "category" : "product_name", "name" : "Red Hat Enterprise Linux AppStream (v. 10)", "product" : { "name" : "Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z", "product_identification_helper" : { "cpe" : "cpe:/o:redhat:enterprise_linux:10.2" } } } ], "category" : "product_family", "name" : "Red Hat Enterprise Linux" }, { "branches" : [ { "category" : "product_version", "name" : "nodejs-1:22.23.4-1.el10_2.aarch64", "product" : { "name" : "nodejs-1:22.23.4-1.el10_2.aarch64", "product_id" : "nodejs-1:22.23.4-1.el10_2.aarch64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs@22.23.4-1.el10_2?arch=aarch64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-devel-1:22.23.4-1.el10_2.aarch64", "product" : { "name" : "nodejs-devel-1:22.23.4-1.el10_2.aarch64", "product_id" : "nodejs-devel-1:22.23.4-1.el10_2.aarch64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-devel@22.23.4-1.el10_2?arch=aarch64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "product" : { "name" : "nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "product_id" : "nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-full-i18n@22.23.4-1.el10_2?arch=aarch64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-libs-1:22.23.4-1.el10_2.aarch64", "product" : { "name" : "nodejs-libs-1:22.23.4-1.el10_2.aarch64", "product_id" : "nodejs-libs-1:22.23.4-1.el10_2.aarch64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-libs@22.23.4-1.el10_2?arch=aarch64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "product" : { "name" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "product_id" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-npm@10.9.9-1.22.23.4.1.el10_2?arch=aarch64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "product" : { "name" : "nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "product_id" : "nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs22-debugsource@22.23.4-1.el10_2?arch=aarch64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "product" : { "name" : "nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "product_id" : "nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-debuginfo@22.23.4-1.el10_2?arch=aarch64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "product" : { "name" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "product_id" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.4-1.el10_2?arch=aarch64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "product" : { "name" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "product_id" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs22-debuginfo@22.23.4-1.el10_2?arch=aarch64&epoch=1" } } } ], "category" : "architecture", "name" : "aarch64" }, { "branches" : [ { "category" : "product_version", "name" : "nodejs-1:22.23.4-1.el10_2.ppc64le", "product" : { "name" : "nodejs-1:22.23.4-1.el10_2.ppc64le", "product_id" : "nodejs-1:22.23.4-1.el10_2.ppc64le", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs@22.23.4-1.el10_2?arch=ppc64le&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "product" : { "name" : "nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "product_id" : "nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-devel@22.23.4-1.el10_2?arch=ppc64le&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "product" : { "name" : "nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "product_id" : "nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-full-i18n@22.23.4-1.el10_2?arch=ppc64le&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "product" : { "name" : "nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "product_id" : "nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-libs@22.23.4-1.el10_2?arch=ppc64le&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "product" : { "name" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "product_id" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-npm@10.9.9-1.22.23.4.1.el10_2?arch=ppc64le&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "product" : { "name" : "nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "product_id" : "nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs22-debugsource@22.23.4-1.el10_2?arch=ppc64le&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "product" : { "name" : "nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "product_id" : "nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-debuginfo@22.23.4-1.el10_2?arch=ppc64le&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "product" : { "name" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "product_id" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.4-1.el10_2?arch=ppc64le&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "product" : { "name" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "product_id" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs22-debuginfo@22.23.4-1.el10_2?arch=ppc64le&epoch=1" } } } ], "category" : "architecture", "name" : "ppc64le" }, { "branches" : [ { "category" : "product_version", "name" : "nodejs-1:22.23.4-1.el10_2.s390x", "product" : { "name" : "nodejs-1:22.23.4-1.el10_2.s390x", "product_id" : "nodejs-1:22.23.4-1.el10_2.s390x", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs@22.23.4-1.el10_2?arch=s390x&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-devel-1:22.23.4-1.el10_2.s390x", "product" : { "name" : "nodejs-devel-1:22.23.4-1.el10_2.s390x", "product_id" : "nodejs-devel-1:22.23.4-1.el10_2.s390x", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-devel@22.23.4-1.el10_2?arch=s390x&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "product" : { "name" : "nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "product_id" : "nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-full-i18n@22.23.4-1.el10_2?arch=s390x&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-libs-1:22.23.4-1.el10_2.s390x", "product" : { "name" : "nodejs-libs-1:22.23.4-1.el10_2.s390x", "product_id" : "nodejs-libs-1:22.23.4-1.el10_2.s390x", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-libs@22.23.4-1.el10_2?arch=s390x&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "product" : { "name" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "product_id" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-npm@10.9.9-1.22.23.4.1.el10_2?arch=s390x&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "product" : { "name" : "nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "product_id" : "nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs22-debugsource@22.23.4-1.el10_2?arch=s390x&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "product" : { "name" : "nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "product_id" : "nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-debuginfo@22.23.4-1.el10_2?arch=s390x&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "product" : { "name" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "product_id" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.4-1.el10_2?arch=s390x&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "product" : { "name" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "product_id" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs22-debuginfo@22.23.4-1.el10_2?arch=s390x&epoch=1" } } } ], "category" : "architecture", "name" : "s390x" }, { "branches" : [ { "category" : "product_version", "name" : "nodejs-1:22.23.4-1.el10_2.x86_64", "product" : { "name" : "nodejs-1:22.23.4-1.el10_2.x86_64", "product_id" : "nodejs-1:22.23.4-1.el10_2.x86_64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs@22.23.4-1.el10_2?arch=x86_64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-devel-1:22.23.4-1.el10_2.x86_64", "product" : { "name" : "nodejs-devel-1:22.23.4-1.el10_2.x86_64", "product_id" : "nodejs-devel-1:22.23.4-1.el10_2.x86_64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-devel@22.23.4-1.el10_2?arch=x86_64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "product" : { "name" : "nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "product_id" : "nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-full-i18n@22.23.4-1.el10_2?arch=x86_64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-libs-1:22.23.4-1.el10_2.x86_64", "product" : { "name" : "nodejs-libs-1:22.23.4-1.el10_2.x86_64", "product_id" : "nodejs-libs-1:22.23.4-1.el10_2.x86_64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-libs@22.23.4-1.el10_2?arch=x86_64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "product" : { "name" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "product_id" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-npm@10.9.9-1.22.23.4.1.el10_2?arch=x86_64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64", "product" : { "name" : "nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64", "product_id" : "nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs22-debugsource@22.23.4-1.el10_2?arch=x86_64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "product" : { "name" : "nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "product_id" : "nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-debuginfo@22.23.4-1.el10_2?arch=x86_64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "product" : { "name" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "product_id" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-libs-debuginfo@22.23.4-1.el10_2?arch=x86_64&epoch=1" } } }, { "category" : "product_version", "name" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "product" : { "name" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "product_id" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs22-debuginfo@22.23.4-1.el10_2?arch=x86_64&epoch=1" } } } ], "category" : "architecture", "name" : "x86_64" }, { "branches" : [ { "category" : "product_version", "name" : "nodejs-docs-1:22.23.4-1.el10_2.noarch", "product" : { "name" : "nodejs-docs-1:22.23.4-1.el10_2.noarch", "product_id" : "nodejs-docs-1:22.23.4-1.el10_2.noarch", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs-docs@22.23.4-1.el10_2?arch=noarch&epoch=1" } } } ], "category" : "architecture", "name" : "noarch" }, { "branches" : [ { "category" : "product_version", "name" : "nodejs22-1:22.23.4-1.el10_2.src", "product" : { "name" : "nodejs22-1:22.23.4-1.el10_2.src", "product_id" : "nodejs22-1:22.23.4-1.el10_2.src", "product_identification_helper" : { "purl" : "pkg:rpm/redhat/nodejs22@22.23.4-1.el10_2?arch=src&epoch=1" } } } ], "category" : "architecture", "name" : "src" } ], "category" : "vendor", "name" : "Red Hat" } ], "relationships" : [ { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-1:22.23.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64" }, "product_reference" : "nodejs-1:22.23.4-1.el10_2.aarch64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-1:22.23.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le" }, "product_reference" : "nodejs-1:22.23.4-1.el10_2.ppc64le", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-1:22.23.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x" }, "product_reference" : "nodejs-1:22.23.4-1.el10_2.s390x", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-1:22.23.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64" }, "product_reference" : "nodejs-1:22.23.4-1.el10_2.x86_64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64" }, "product_reference" : "nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le" }, "product_reference" : "nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-debuginfo-1:22.23.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x" }, "product_reference" : "nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64" }, "product_reference" : "nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-devel-1:22.23.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64" }, "product_reference" : "nodejs-devel-1:22.23.4-1.el10_2.aarch64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-devel-1:22.23.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le" }, "product_reference" : "nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-devel-1:22.23.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x" }, "product_reference" : "nodejs-devel-1:22.23.4-1.el10_2.s390x", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-devel-1:22.23.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64" }, "product_reference" : "nodejs-devel-1:22.23.4-1.el10_2.x86_64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-docs-1:22.23.4-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch" }, "product_reference" : "nodejs-docs-1:22.23.4-1.el10_2.noarch", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64" }, "product_reference" : "nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le" }, "product_reference" : "nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-full-i18n-1:22.23.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x" }, "product_reference" : "nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64" }, "product_reference" : "nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-libs-1:22.23.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64" }, "product_reference" : "nodejs-libs-1:22.23.4-1.el10_2.aarch64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-libs-1:22.23.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le" }, "product_reference" : "nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-libs-1:22.23.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x" }, "product_reference" : "nodejs-libs-1:22.23.4-1.el10_2.s390x", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-libs-1:22.23.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64" }, "product_reference" : "nodejs-libs-1:22.23.4-1.el10_2.x86_64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64" }, "product_reference" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le" }, "product_reference" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x" }, "product_reference" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64" }, "product_reference" : "nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64" }, "product_reference" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le" }, "product_reference" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x" }, "product_reference" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64" }, "product_reference" : "nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs22-1:22.23.4-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src" }, "product_reference" : "nodejs22-1:22.23.4-1.el10_2.src", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64" }, "product_reference" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le" }, "product_reference" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x" }, "product_reference" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64" }, "product_reference" : "nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64" }, "product_reference" : "nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le" }, "product_reference" : "nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs22-debugsource-1:22.23.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x" }, "product_reference" : "nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "relates_to_product_reference" : "AppStream-10.2.Z" }, { "category" : "default_component_of", "full_product_name" : { "name" : "nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)", "product_id" : "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" }, "product_reference" : "nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64", "relates_to_product_reference" : "AppStream-10.2.Z" } ] }, "vulnerabilities" : [ { "cve" : "CVE-2026-87018", "cwe" : { "id" : "CWE-617", "name" : "Reachable Assertion" }, "discovery_date" : "2026-10-15T18:45:26.683580+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2553677" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in undici. A remote server can cause a Denial of Service (DoS) by initiating a Transport Layer Security (TLS) renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught assertion is triggered, terminating the client process and disrupting active network requests.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is evaluated as an Important severity flaw for Red Hat products because an unauthenticated remote server can terminate a client Node.js process, halting all concurrent tasks and in-flight operations. In typical Red Hat deployments, containerized microservices and administrative consoles rely on undici or runtime fetch APIs to communicate with external web endpoints. Exploitation requires the client application to establish an outbound TLS 1.2 connection to a malicious or compromised endpoint that initiates session renegotiation with a non-matching certificate. Workloads communicating strictly with trusted endpoints or utilizing TLS 1.3 connections are inherently protected, as TLS 1.3 does not permit server-driven renegotiation.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-87018" }, { "category" : "external", "summary" : "RHBZ#2553677", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2553677" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-87018", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-87018" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-87018", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-87018" }, { "category" : "external", "summary" : "https://cna.openjsf.org/security-advisories.html", "url" : "https://cna.openjsf.org/security-advisories.html" }, { "category" : "external", "summary" : "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm", "url" : "https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm" } ], "release_date" : "2026-10-15T18:38:25.613000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T03:57:18+00:00", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:96094" } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version" : "3.1" }, "products" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "undici: undici: Denial of Service via TLS renegotiation with mismatched certificate" }, { "cve" : "CVE-2026-102276", "cwe" : { "id" : "CWE-770", "name" : "Allocation of Resources Without Limits or Throttling" }, "discovery_date" : "2026-09-28T21:02:20.910434+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2542707" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial of Service (DoS).", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "Red Hat Product Security rates the severity of this vulnerability as Important because an unauthenticated remote attacker can crash running Node.js services by submitting malformed pattern strings, resulting in a denial of service. In Red Hat environments, applications that accept arbitrary glob or expansion patterns from external inputs are susceptible to unexpected termination due to an unhandled call stack overflow. While this flaw allows service interruption without requiring privileges, it does not lead to code execution or compromise data confidentiality and integrity.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-102276" }, { "category" : "external", "summary" : "RHBZ#2542707", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2542707" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-102276", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-102276" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102276", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102276" }, { "category" : "external", "summary" : "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc", "url" : "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc" }, { "category" : "external", "summary" : "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c", "url" : "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c" }, { "category" : "external", "summary" : "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc", "url" : "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc" }, { "category" : "external", "summary" : "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3", "url" : "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3" }, { "category" : "external", "summary" : "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p", "url" : "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p" } ], "release_date" : "2026-09-28T20:50:59.984000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T03:57:18+00:00", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:96094" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version" : "3.1" }, "products" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns" }, { "cve" : "CVE-2026-102278", "cwe" : { "id" : "CWE-770", "name" : "Allocation of Resources Without Limits or Throttling" }, "discovery_date" : "2026-09-28T21:00:55.949756+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2542700" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the application to crash.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as Important because remote unauthenticated attackers can supply crafted nested expressions to trigger native stack exhaustion and crash server-side processes, resulting in a denial of service without compromising system confidentiality or integrity. In Red Hat environments, the affected library is distributed across containerized web consoles, developer tools, and Node.js runtime environments. Exploitation is constrained to deployments where applications process untrusted, user-defined pattern inputs directly through expansion functions without input depth validation.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-102278" }, { "category" : "external", "summary" : "RHBZ#2542700", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2542700" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-102278", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-102278" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102278", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-102278" }, { "category" : "external", "summary" : "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b", "url" : "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b" }, { "category" : "external", "summary" : "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c", "url" : "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c" }, { "category" : "external", "summary" : "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db", "url" : "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db" }, { "category" : "external", "summary" : "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7", "url" : "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7" } ], "release_date" : "2026-09-28T20:57:09.850000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T03:57:18+00:00", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:96094" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 6.5, "baseSeverity" : "MEDIUM", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "REQUIRED", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version" : "3.1" }, "products" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns" }, { "acknowledgments" : [ { "names" : [ "Hasan Flayyih Abdullah" ], "summary" : "Acknowledged by upstream." } ], "cve" : "CVE-2026-105482", "cwe" : { "id" : "CWE-158", "name" : "Improper Neutralization of Null Byte or NUL Character" }, "discovery_date" : "2026-10-21T00:00:00+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2559875" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in the Node.js DNS resolver APIs. Hostnames passed to dns.resolve that contain an embedded NUL character can be truncated when processed by c-ares. An attacker who can supply such a name may cause the application to resolve and act on an unintended hostname.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This issue is rated Important. Exploitation requires that the application resolve an attacker-influenced hostname containing an embedded NUL via dns.resolve (callback or promise APIs). Attack Complexity is High because the NUL-bearing name must reach those APIs and the application must rely on the returned records (for example to open a subsequent connection). Successful abuse can redirect trust in name resolution and lead to confidentiality and integrity impact comparable to connecting to the wrong host; Availability is not directly affected. Upstream rates this High and fixed it in Node.js 22.23.4, 24.22.1, and 26.12.1.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-105482" }, { "category" : "external", "summary" : "RHBZ#2559875", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2559875" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-105482", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-105482" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-105482", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-105482" }, { "category" : "external", "summary" : "https://nodejs.org/en/blog/release/v22.23.4", "url" : "https://nodejs.org/en/blog/release/v22.23.4" }, { "category" : "external", "summary" : "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "url" : "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases" } ], "release_date" : "2026-10-21T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T03:57:18+00:00", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:96094" }, { "category" : "workaround", "details" : "To mitigate, do not pass untrusted strings into dns.resolve; reject hostnames that contain embedded NUL bytes before DNS resolution. Limit which components may perform DNS lookups on attacker-influenced names, and restrict network reachability of those services.\n\n--- CME Mitigation Guidance (2026-11-02) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to reject hostnames containing embedded NUL bytes before passing them to Node.js DNS resolution APIs or underlying c-ares C strings: upgrade to Node.js 22.23.4, 24.22.1, and 26.12.1 (or the fixed Nodejs/Hi/Nodejs/Nodejs:24/Nodejs/Nodejs:22/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which validate resolve inputs and reject hostnames containing null bytes before passing them to c-ares, closing all 2 injection vectors (embedded NUL byte hostname truncation, domain allowlist validation bypass). Until patched, this is a concern on Applications running Node.js that resolve untrusted, attacker-influenced hostnames via dns.resolve or dns.reverse APIs, so Reject hostnames containing embedded NUL characters before calling dns.resolve or dns.reverse, and restrict which components perform DNS lookups on untrusted input. As a compensating measure, Enforce outbound network egress filtering to restrict unauthorized application connections if a truncated hostname resolves to external destinations and Implement certificate pinning to prevent establishing TLS sessions when connecting to unintended hosts that do not match expected pinned certificates. These controls limit blast radius and contain exploitation, but they do not fix the underlying embedded NUL byte hostname truncation defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)", "product_ids" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character" }, { "acknowledgments" : [ { "names" : [ "anagnorisis2peripeteia" ], "summary" : "Acknowledged by upstream." } ], "cve" : "CVE-2026-106069", "cwe" : { "id" : "CWE-297", "name" : "Improper Validation of Certificate with Host Mismatch" }, "discovery_date" : "2026-10-21T00:00:00+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2559873" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not identify the peer that was actually connected, allowing server impersonation.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This issue is rated Important. Exploitation requires a Node.js TLS client to connect using a non-canonical numeric hostname that normalizes to an IP address for certificate matching while name resolution uses a different interpretation, and a certificate that includes an IP subjectAltName matching the normalized address. Attack Complexity is High due to these prerequisites and the need to influence the connection target or traffic. Confidentiality and Integrity are High for a successful impersonation of a TLS peer; Availability is not affected. Upstream rates this High and fixed it in Node.js 22.23.4, 24.22.1, and 26.12.1.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-106069" }, { "category" : "external", "summary" : "RHBZ#2559873", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2559873" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-106069", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-106069" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-106069", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-106069" }, { "category" : "external", "summary" : "https://nodejs.org/en/blog/release/v22.23.4", "url" : "https://nodejs.org/en/blog/release/v22.23.4" }, { "category" : "external", "summary" : "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "url" : "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases" } ], "release_date" : "2026-10-21T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T03:57:18+00:00", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:96094" }, { "category" : "workaround", "details" : "To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input.\n\n--- CME Mitigation Guidance (2026-11-02) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to validate and canonicalize numeric hostnames prior to TLS client connection setup to eliminate normalization discrepancies against the platform resolver: upgrade to Node.js 22.23.4, 24.22.1, 26.12.1 (or the fixed Nodejs/Nodejs:22/Nodejs/Nodejs:24/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which reject non-canonical IP addresses during hostname verification, closing all 2 injection vectors (IPv4 literal with leading zero octal notation, abbreviated numeric IPv4 address format). Until patched, this is a concern on Node.js TLS client applications connecting to untrusted hostnames across supported platforms, so reject non-canonical numeric hostnames before initiating TLS connections, restrict outbound TLS requests to trusted destinations, and isolate client services handling untrusted connection targets. As a compensating measure, pin expected server certificates or public keys to reject unauthorized peer certificates even if hostname verification is deceived by address normalization differences. These controls limit blast radius and contain exploitation, but they do not fix the underlying hostname normalization discrepancy defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1304 SSRF Prevention (Outbound Request Allowlist) (high)", "product_ids" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames" }, { "cve" : "CVE-2026-109383", "cwe" : { "id" : "CWE-295", "name" : "Improper Certificate Validation" }, "discovery_date" : "2026-10-15T18:45:43.553803+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2553678" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in undici. This vulnerability may allow a remote attacker to intercept or modify encrypted communications by bypassing custom certificate validation. The issue occurs because the Agent dispatcher discards caller-supplied Transport Layer Security (TLS) verification functions during internal configuration copying, causing the client to silently ignore application-specific checks such as certificate or public-key pinning.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "undici: undici: Certificate validation bypass via dropped TLS options in Agent", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as having an Important severity for Red Hat products because an attacker positioned on the network could bypass custom cryptographic protections, allowing the interception or tampering of sensitive traffic. Standard system trust stores and default certificate chain validations are not compromised by this flaw, which reduces exposure for environments relying solely on standard public key infrastructure. The elevated risk is restricted to services and applications that configure specialized certificate validation handlers, such as explicit certificate or public key pinning, when establishing outbound connections.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-109383" }, { "category" : "external", "summary" : "RHBZ#2553678", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2553678" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-109383", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-109383" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-109383", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-109383" }, { "category" : "external", "summary" : "https://cna.openjsf.org/security-advisories.html", "url" : "https://cna.openjsf.org/security-advisories.html" }, { "category" : "external", "summary" : "https://github.com/nodejs/undici/commit/f75eac00ac17", "url" : "https://github.com/nodejs/undici/commit/f75eac00ac17" }, { "category" : "external", "summary" : "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx", "url" : "https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx" } ], "release_date" : "2026-10-15T18:34:01.468000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T03:57:18+00:00", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:96094" } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "undici: undici: Certificate validation bypass via dropped TLS options in Agent" }, { "cve" : "CVE-2026-109829", "cwe" : { "id" : "CWE-346", "name" : "Origin Validation Error" }, "discovery_date" : "2026-10-15T18:45:59.990034+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2553679" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in undici. When an application configures redirect handling alongside a shared cache, responses received after cross-origin redirects are incorrectly stored under the initial request URL. A remote attacker who controls a redirect destination can exploit this vulnerability to poison the shared cache, serving malicious content to subsequent users requesting trusted URLs. Additionally, this behavior can result in information disclosure if private or user-specific responses are cached and delivered to unauthorized callers.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as Important severity because successful exploitation enables remote attackers to achieve shared cache poisoning and unauthorized cross-user data exposure across network boundaries without requiring elevated privileges. Within Red Hat environments shipping Node.js runtimes and associated container services, undici is utilized as an HTTP client backend. However, exploitation requires a specific application architecture where an originless dispatcher chains redirect processing ahead of a shared cache store, rather than the default standalone client configurations. Deployments that do not implement shared caching across multi-origin redirect flows or that isolate cache storage per origin remain unaffected by this flaw.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-109829" }, { "category" : "external", "summary" : "RHBZ#2553679", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2553679" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-109829", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-109829" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-109829", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-109829" }, { "category" : "external", "summary" : "https://cna.openjsf.org/security-advisories.html", "url" : "https://cna.openjsf.org/security-advisories.html" }, { "category" : "external", "summary" : "https://github.com/nodejs/undici/commit/26c2bfb3def0", "url" : "https://github.com/nodejs/undici/commit/26c2bfb3def0" }, { "category" : "external", "summary" : "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26", "url" : "https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26" } ], "release_date" : "2026-10-15T18:28:04.954000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T03:57:18+00:00", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:96094" } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching" }, { "cve" : "CVE-2026-109869", "cwe" : { "id" : "CWE-248", "name" : "Uncaught Exception" }, "discovery_date" : "2026-10-15T18:31:39.700754+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2553656" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in undici. When an application sends a request to a malicious remote server, the server can return a response with excessive content encodings and immediately close the connection. Because the underlying response stream is left unhandled, this abrupt closure triggers an unhandled error that causes the application process to crash. Consequently, an attacker operating a remote server can cause a Denial of Service (DoS), terminating the application even if standard error handling is implemented.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "undici: undici: Denial of Service via unhandled stream error on excessive content encodings", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as an Important severity because an unauthenticated remote server can trigger an unhandled runtime error that abruptly terminates the parent Node.js process, bypassing application-level catch blocks. In Red Hat products and containerized workloads running affected Node.js runtimes, the flaw impacts services executing outbound HTTP calls to untrusted or external third-party endpoints. Conversely, deployments where applications only interact with verified internal endpoints or do not fetch content from untrusted remote hosts are not exposed to this denial-of-service condition.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-109869" }, { "category" : "external", "summary" : "RHBZ#2553656", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2553656" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-109869", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-109869" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-109869", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-109869" }, { "category" : "external", "summary" : "https://cna.openjsf.org/security-advisories.html", "url" : "https://cna.openjsf.org/security-advisories.html" }, { "category" : "external", "summary" : "https://github.com/nodejs/undici/commit/b5084c7dc239", "url" : "https://github.com/nodejs/undici/commit/b5084c7dc239" }, { "category" : "external", "summary" : "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c", "url" : "https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c" } ], "release_date" : "2026-10-15T18:08:31.243000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T03:57:18+00:00", "details" : "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:96094" } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version" : "3.1" }, "products" : [ "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-devel-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-docs-1:22.23.4-1.el10_2.noarch", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-full-i18n-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs-libs-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.aarch64", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.s390x", "AppStream-10.2.Z:nodejs-npm-1:10.9.9-1.22.23.4.1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-1:22.23.4-1.el10_2.src", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debuginfo-1:22.23.4-1.el10_2.x86_64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.aarch64", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.ppc64le", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.s390x", "AppStream-10.2.Z:nodejs22-debugsource-1:22.23.4-1.el10_2.x86_64" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "undici: undici: Denial of Service via unhandled stream error on excessive content encodings" } ] }