RHSA-2026:87703HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 22, 2026
Last Modified
November 10, 2026

🔗 CVE IDs covered (7)

CVE-2026-87018 →CVE-2026-105482 →CVE-2026-105483 →CVE-2026-109383 →CVE-2026-109869 →CVE-2026-109924 →CVE-2026-109932 →

📋 Description

CVE-2026-87018 — undici: undici: Denial of Service via TLS renegotiation with mismatched certificate CVE-2026-105482 — nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character CVE-2026-105483 — nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames CVE-2026-109383 — undici: undici: Certificate validation bypass via dropped TLS options in Agent CVE-2026-109869 — undici: undici: Denial of Service via unhandled stream error on excessive content encodings CVE-2026-109924 — undici: undici: Denial of Service via memory exhaustion in EventSource client CVE-2026-109932 — undici: undici: Denial of Service via unbounded WebSocket PONG buffering

🎯 Affected products29

  • Red Hat Hardened Images
  • nodejs26-1:26.12.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs26-1:26.12.1-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • nodejs26-1:26.12.1-0.1.hum1@src as a component of Red Hat Hardened Images
  • nodejs26-1:26.12.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • nodejs26-devel-1:26.12.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs26-devel-1:26.12.1-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • nodejs26-devel-1:26.12.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs26-libs-1:26.12.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs26-libs-1:26.12.1-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • nodejs26-libs-1:26.12.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x as a component of Red Hat Hardened Images
  • v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate, do not pass untrusted strings into dns.resolve; reject hostnames that contain embedded NUL bytes before DNS resolution. Limit which components may perform DNS lookups on attacker-influenced names, and restrict network reachability of those services. --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to reject hostnames containing embedded NUL bytes before passing them to Node.js DNS resolution APIs or underlying c-ares C strings: upgrade to Node.js 22.23.4, 24.22.1, and 26.12.1 (or the fixed Nodejs/Hi/Nodejs/Nodejs:24/Nodejs/Nodejs:22/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which validate resolve inputs and reject hostnames containing null bytes before passing them to c-ares, closing all 2 injection vectors (embedded NUL byte hostname truncation, domain allowlist validation bypass). Until patched, this is a concern on Applications running Node.js that resolve untrusted, attacker-influenced hostnames via dns.resolve or dns.reverse APIs, so Reject hostnames containing embedded NUL characters before calling dns.resolve or dns.reverse, and restrict which components perform DNS lookups on untrusted input. As a compensating measure, Enforce outbound network egress filtering to restrict unauthorized application connections if a truncated hostname resolves to external destinations and Implement certificate pinning to prevent establishing TLS sessions when connecting to unintended hosts that do not match expected pinned certificates. These controls limit blast radius and contain exploitation, but they do not fix the underlying embedded NUL byte hostname truncation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high) Workaround: To mitigate do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits into TLS clients such as tls.connect, https.request, or fetch. Restrict outbound TLS connections to trusted destinations only, and segment services that initiate TLS client connections from untrusted networks. --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to normalize hostnames and IP representations to standard ASCII before passing destination strings to TLS client calls such as tls.connect, https.request, or fetch: upgrade to Node.js v24.22.1, v26.12.1 (or the fixed Nodejs/Nodejs:24/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which fix IP normalization regression in TLS hostname validation to ensure fullwidth digit hostnames are recognized as IP addresses, closing all 2 injection vectors (fullwidth Unicode digit IPv4 connection strings, DNS SAN matching on numeric hostnames). Until patched, this is only a concern on Node.js applications running on 24.x and 26.x runtimes establishing TLS client connections — Node.js 22.x deployments are unaffected — so Do not pass untrusted hostnames or URLs that may contain non-ASCII or fullwidth digits into TLS clients, and restrict outbound TLS connections to trusted destinations. As a compensating measure, Restrict outbound requests to a validated destination allowlist to prevent arbitrary attacker-controlled host strings from reaching Node.js TLS clients and Segment services initiating TLS client connections from untrusted networks to prevent attackers from intercepting or impersonating connections. These controls limit blast radius and contain exploitation, but they do not fix the underlying TLS IP hostname normalization defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)

🔗 References (11)