RHSA-2026:96088HighCVSS 7.5

Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

Published
November 9, 2026
Last Modified
November 10, 2026

🔗 CVE IDs covered (9)

CVE-2026-109383 →CVE-2026-109829 →CVE-2026-109869 →CVE-2026-87018 →CVE-2026-102276 →CVE-2026-102278 →CVE-2026-105482 →CVE-2026-105483 →CVE-2026-106069 →

📋 Description

CVE-2026-87018 — undici: undici: Denial of Service via TLS renegotiation with mismatched certificate CVE-2026-102276 — brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns CVE-2026-102278 — brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns CVE-2026-105482 — nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character CVE-2026-105483 — nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames CVE-2026-106069 — nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames CVE-2026-109383 — undici: undici: Certificate validation bypass via dropped TLS options in Agent CVE-2026-109829 — undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching CVE-2026-109869 — undici: undici: Denial of Service via unhandled stream error on excessive content encodings

🎯 Affected products32

  • Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-1:24.22.1-3.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-1:24.22.1-3.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-1:24.22.1-3.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-1:24.22.1-3.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-1:24.22.1-3.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-debuginfo-1:24.22.1-3.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-debuginfo-1:24.22.1-3.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-debuginfo-1:24.22.1-3.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-debuginfo-1:24.22.1-3.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-debugsource-1:24.22.1-3.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-debugsource-1:24.22.1-3.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-debugsource-1:24.22.1-3.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-debugsource-1:24.22.1-3.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-devel-1:24.22.1-3.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-devel-1:24.22.1-3.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-devel-1:24.22.1-3.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-devel-1:24.22.1-3.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-docs-1:24.22.1-3.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-full-i18n-1:24.22.1-3.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-full-i18n-1:24.22.1-3.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-full-i18n-1:24.22.1-3.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-full-i18n-1:24.22.1-3.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-libs-1:24.22.1-3.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-libs-1:24.22.1-3.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-libs-1:24.22.1-3.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-libs-1:24.22.1-3.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-libs-debuginfo-1:24.22.1-3.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-libs-debuginfo-1:24.22.1-3.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • nodejs24-libs-debuginfo-1:24.22.1-3.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +2 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate, do not pass untrusted strings into dns.resolve; reject hostnames that contain embedded NUL bytes before DNS resolution. Limit which components may perform DNS lookups on attacker-influenced names, and restrict network reachability of those services. --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to reject hostnames containing embedded NUL bytes before passing them to Node.js DNS resolution APIs or underlying c-ares C strings: upgrade to Node.js 22.23.4, 24.22.1, and 26.12.1 (or the fixed Nodejs/Hi/Nodejs/Nodejs:24/Nodejs/Nodejs:22/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which validate resolve inputs and reject hostnames containing null bytes before passing them to c-ares, closing all 2 injection vectors (embedded NUL byte hostname truncation, domain allowlist validation bypass). Until patched, this is a concern on Applications running Node.js that resolve untrusted, attacker-influenced hostnames via dns.resolve or dns.reverse APIs, so Reject hostnames containing embedded NUL characters before calling dns.resolve or dns.reverse, and restrict which components perform DNS lookups on untrusted input. As a compensating measure, Enforce outbound network egress filtering to restrict unauthorized application connections if a truncated hostname resolves to external destinations and Implement certificate pinning to prevent establishing TLS sessions when connecting to unintended hosts that do not match expected pinned certificates. These controls limit blast radius and contain exploitation, but they do not fix the underlying embedded NUL byte hostname truncation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high) Workaround: To mitigate do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits into TLS clients such as tls.connect, https.request, or fetch. Restrict outbound TLS connections to trusted destinations only, and segment services that initiate TLS client connections from untrusted networks. --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to normalize hostnames and IP representations to standard ASCII before passing destination strings to TLS client calls such as tls.connect, https.request, or fetch: upgrade to Node.js v24.22.1, v26.12.1 (or the fixed Nodejs/Nodejs:24/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which fix IP normalization regression in TLS hostname validation to ensure fullwidth digit hostnames are recognized as IP addresses, closing all 2 injection vectors (fullwidth Unicode digit IPv4 connection strings, DNS SAN matching on numeric hostnames). Until patched, this is only a concern on Node.js applications running on 24.x and 26.x runtimes establishing TLS client connections — Node.js 22.x deployments are unaffected — so Do not pass untrusted hostnames or URLs that may contain non-ASCII or fullwidth digits into TLS clients, and restrict outbound TLS connections to trusted destinations. As a compensating measure, Restrict outbound requests to a validated destination allowlist to prevent arbitrary attacker-controlled host strings from reaching Node.js TLS clients and Segment services initiating TLS client connections from untrusted networks to prevent attackers from intercepting or impersonating connections. These controls limit blast radius and contain exploitation, but they do not fix the underlying TLS IP hostname normalization defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high) Workaround: To mitigate, reject non-canonical numeric hostnames before opening TLS connections. Restrict outbound TLS to trusted destinations only, and isolate services that make TLS client connections based on untrusted input. --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to validate and canonicalize numeric hostnames prior to TLS client connection setup to eliminate normalization discrepancies against the platform resolver: upgrade to Node.js 22.23.4, 24.22.1, 26.12.1 (or the fixed Nodejs/Nodejs:22/Nodejs/Nodejs:24/Nodejs/Nodejs:26/Nodejs/Cloudservices/Subscription Central Automation builds), which reject non-canonical IP addresses during hostname verification, closing all 2 injection vectors (IPv4 literal with leading zero octal notation, abbreviated numeric IPv4 address format). Until patched, this is a concern on Node.js TLS client applications connecting to untrusted hostnames across supported platforms, so reject non-canonical numeric hostnames before initiating TLS connections, restrict outbound TLS requests to trusted destinations, and isolate client services handling untrusted connection targets. As a compensating measure, pin expected server certificates or public keys to reject unauthorized peer certificates even if hostname verification is deceived by address normalization differences. These controls limit blast radius and contain exploitation, but they do not fix the underlying hostname normalization discrepancy defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1304 SSRF Prevention (Outbound Request Allowlist) (high)

🔗 References (12)