RHSA-2026:97855HighCVSS 7.7

Red Hat Security Advisory: nodejs:26 security update

Published
November 10, 2026
Last Modified
November 11, 2026

🔗 CVE IDs covered (26)

CVE-2026-58045 →CVE-2026-19534 →CVE-2026-48618 →CVE-2026-48930 →CVE-2026-48936 →CVE-2026-58039 →CVE-2026-58040 →CVE-2026-58041 →CVE-2026-58044 →CVE-2026-48619 →CVE-2026-48933 →CVE-2026-48934 →CVE-2026-58042 →CVE-2026-84961 →CVE-2026-85152 →CVE-2026-13697 →CVE-2026-48931 →CVE-2026-48935 →CVE-2026-56846 →CVE-2026-56847 →CVE-2026-56850 →CVE-2026-58043 →CVE-2026-48615 →CVE-2026-48617 →CVE-2026-48928 →CVE-2026-56848 →

📋 Description

CVE-2026-13697 — undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives CVE-2026-19534 — undici: undici: Denial of Service via unrequested WebSocket subprotocol CVE-2026-48615 — nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling CVE-2026-48617 — nodejs: Node.js: Permission Model bypass via process.report.writeReport() path misvalidation CVE-2026-48618 — nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch CVE-2026-48619 — nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames CVE-2026-48928 — Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency CVE-2026-48930 — nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling CVE-2026-48931 — nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance CVE-2026-48933 — nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() CVE-2026-48934 — nodejs: Node.js: Certification validation bypass in TLS host verification CVE-2026-48935 — nodejs: Node.js: Unauthorized file metadata modification CVE-2026-48936 — nodejs: Node.js: Local server can be started without network permission via Permission API flaw CVE-2026-56846 — nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks CVE-2026-56847 — nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions CVE-2026-56848 — nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service CVE-2026-56850 — nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw CVE-2026-58039 — nodejs: Information disclosure due to improper permission enforcement CVE-2026-58040 — nodejs: HTTPS Agent TLS session reuse skips hostname verification CVE-2026-58041 — nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator CVE-2026-58042 — nodejs: Node.js: Denial of Service via DNS responses with excessive A records CVE-2026-58043 — nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58044 — nodejs: Node.js: Request smuggling via HTTP client header truncation CVE-2026-58045 — nodejs: Node.js: Denial of Service vulnerability CVE-2026-84961 — undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options CVE-2026-85152 — undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation

🎯 Affected products41

  • Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.src (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-devel-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-docs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.noarch (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.x86_64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.aarch64 (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.ppc64le (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:26.8.2-1.module+el9.9.0+24929+16cef9a5.s390x (nodejs:26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +11 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No workaround is available for applications that rely on the Permission Model to restrict process.report.writeReport() output paths. Users should upgrade to a fixed Node.js release (22.23.0, 24.17.0, or 26.3.1 and later) as they become available downstream. Workaround: Limit outbound HTTP/1.1 from Node.js clients to trusted backend endpoints with egress firewall rules or network segmentation. Avoid keep-alive connection pools to untrusted hosts where operationally feasible. Workaround: To mitigate this issue, restrict network access to Node.js applications utilizing HTTP/2 to trusted clients only, by implementing firewall rules or network access controls. If HTTP/2 functionality is not essential for the application, consider disabling it in the Node.js configuration to prevent exploitation. Always ensure that any service restarts or reloads are performed carefully to avoid service disruption. Workaround: Avoid using the trace_events.createTracing().enable() function in environments that rely on the Node.js Permission Model for file system isolation. Be aware that avoiding this function disables dynamic trace log generation, which may impact performance profiling, APM monitoring, and diagnostic workflows. Workaround: Restrict network access to Node.js HTTP/2 listeners to trusted clients only. If HTTP/2 is not required, disable it to remove the vulnerable handler from the attack surface. Workaround: To mitigate this issue, avoid enabling the experimental Node.js Permission Model by not using the `--experimental-permission` flag. Additionally, ensure that untrusted Node.js workloads are executed within robust operating system isolation primitives, such as Linux containers or cgroups, to limit potential impact. Workaround: To mitigate this issue, Node.js applications should be designed to explicitly configure unique HTTPS agents for each distinct target host. Alternatively, applications can avoid TLS session caching when making outbound HTTPS requests to varied third-party endpoints using shared client instances. Implementing these application-level changes will prevent the vulnerable behavior of skipping hostname verification. Applications may require a restart to apply these changes. Workaround: Applications using Node.js that leverage the experimental `node:sqlite` SQL tag store feature should avoid using `DatabaseSync#createTagStore()` and `StatementSyncIterator` to prevent unintended data modification. If this feature is not essential, refactoring the application to remove its usage will mitigate the vulnerability. Workaround: If unused, avoid dns.resolveAny() (prefer narrower resolvers such as resolve4 / lookup). Use trusted DNS resolvers and block untrusted DNS paths. Note that replacing dns.resolveAny() with narrower resolvers may break application features that depend on retrieving non-IP records, such as MX or TXT. Workaround: Avoid enabling the Node.js Permission Model by not using the `--permission` flag when starting Node.js applications. This prevents the vulnerable enforcement mechanism from being active. Disabling the Permission Model may remove an intended security layer if your application relies on it for sandboxing. Workaround: Applications that do not use BalancedPool, or that use it without a custom function-valued connect/tls option, are not affected and require no action. As a workaround until packages are updated, avoid using BalancedPool for any connection that relies on custom TLS certificate validation (e.g. certificate pinning); use Client, Pool, or Agent instead, which are unaffected. The permanent fix is upgrading undici to 7.29.1 or later (7.x line) or 8.10.2 or later (8.x line). Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible to undici 8.10.2 or later.

🔗 References (29)