Nodejs:24 Security Update — AlmaLinux 8 (ALSA-2026:92376)

ALSA-2026:92376 updates the Node.js 24 module on AlmaLinux 8 with a 13-CVE security batch — including the Brotli decoder fix (CVE-2026-111497) and denial-of-service flaws in ip-address parsing (CVE-2026-101911, CWE-400) — aggregate CVSS 6.3. This is the same upstream Node.js October security wave delivered for the nodejs:24 module: dnf update nodejs and restart Node applications.

High 6.3 CVSS Aktiv ausgenutzt 2026-10-29

AlmaLinux 8

Was das unter einer SharedLicense-Lizenz bedeutet

The batch hardens parsing and memory handling across Node's networking stack — unbounded IPv6 parsing and Brotli decoding are reachable from untrusted input, so applications accepting user-controlled data stay exposed until updated.

Type:

security

Severity:

important

Release date:

2026-10-29

Description:

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
* brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
* nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
* nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
* nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
* nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
* nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

* nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	nodejs-libs-24.22.1-1.module_el8.10.0+4331+0683c9c1.aarch64.rpm	827e06246254fa7a16e7c544f106586a727a3b082c556613037698aa5ab8b2c5
aarch64	nodejs-devel-24.22.1-1.module_el8.10.0+4331+0683c9c1.aarch64.rpm	95068a63cdc4e9cc8d3fda8789913fe13e406f2b6cf8eb1643e4d8b523569e56
aarch64	nodejs-24.22.1-1.module_el8.10.0+4331+0683c9c1.aarch64.rpm	b4de3eba1888a1fff7eb065e98bc2a8585a3799e62c46cb6e8793efac09dbcc4
aarch64	v8-13.6-devel-13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1.aarch64.rpm	bb219dcae73b78b458d977f4d09470eb4b029a0e7a13e5977833c66e235dd781
aarch64	nodejs-full-i18n-24.22.1-1.module_el8.10.0+4331+0683c9c1.aarch64.rpm	dadbe610ffffbb2ef309556fce84b718776d3fa6ead4131fa25ba98f95211c55
noarch	nodejs-docs-24.22.1-1.module_el8.10.0+4331+0683c9c1.noarch.rpm	0831fdbf4e0ab5756be36baa4eb52bacb7a292b881040424cb56242bf3060977
noarch	npm-11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1.noarch.rpm	15dc265687e93859a4b6a59a7954cfad9bba5bf46c98354b2ceaf0efb47e53a0
noarch	nodejs-packaging-2021.06-6.module_el8.10.0+4086+70facd4a.noarch.rpm	318c493f93f2190506361306b5759e5e65eee18e3a8d85b195c800d8b7064bc0
noarch	nodejs-nodemon-3.1.14-2.module_el8.10.0+4250+09238ed4.noarch.rpm	9af610bfd34078e749211d051d0a58ec3936da900b69e735bc529b46435cf37f
noarch	nodejs-packaging-bundler-2021.06-6.module_el8.10.0+4086+70facd4a.noarch.rpm	f4b4a25dc07327deb51619715aae6bd35d22e29ccfc97141c0b61de3a1995eee
ppc64le	nodejs-devel-24.22.1-1.module_el8.10.0+4331+0683c9c1.ppc64le.rpm	1199c6595520b2648e641dbb262b008c0f1e6c7e6dde0d73ec78b6c592cd2271
ppc64le	v8-13.6-devel-13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1.ppc64le.rpm	77b7ba361440110ec67c1a10df35f663edef4f297b93e390ac8a76445c15d66d
ppc64le	nodejs-24.22.1-1.module_el8.10.0+4331+0683c9c1.ppc64le.rpm	e177ece1062928770d06c1cf634c96fe25da97b96c4ae53f753567104eb7b1e3
ppc64le	nodejs-full-i18n-24.22.1-1.module_el8.10.0+4331+0683c9c1.ppc64le.rpm	e2d6ed7b4ac5b66a4a2ac0c2e209737cd5d073b636a92ba27b2cbaf641ea2907
ppc64le	nodejs-libs-24.22.1-1.module_el8.10.0+4331+0683c9c1.ppc64le.rpm	e39359ce9d39df95cfd1a4b419a119f9a1f1e53712da37f060c7213d58933df8
s390x	nodejs-full-i18n-24.22.1-1.module_el8.10.0+4331+0683c9c1.s390x.rpm	1610b6537dfd96255d45b9d03059c452d2886085668c71e11ab4d75fec87f36b
s390x	v8-13.6-devel-13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1.s390x.rpm	253459a016fb5a3b452e84add75d077b0d916d910f29bcb4e65698283c566c22
s390x	nodejs-devel-24.22.1-1.module_el8.10.0+4331+0683c9c1.s390x.rpm	9ba0698b8c0aa3a8d44550649af3d45456ba030f2569b283cf6bd05f88ddf978
s390x	nodejs-libs-24.22.1-1.module_el8.10.0+4331+0683c9c1.s390x.rpm	daabe0b134d5fd4cce34dd5c41205e7b8f376d1b260a30c9d2d21da8b91480ad
s390x	nodejs-24.22.1-1.module_el8.10.0+4331+0683c9c1.s390x.rpm	f6ee0003aa9a5a9c78fc2ae7e71faec9c5954237961e8e3d487866daf370a372
x86_64	nodejs-devel-24.22.1-1.module_el8.10.0+4331+0683c9c1.x86_64.rpm	3f2bd8519b5711fd067e3ff7fac07c81c2d24e5c25972c1731c9a0768b39b037
x86_64	nodejs-full-i18n-24.22.1-1.module_el8.10.0+4331+0683c9c1.x86_64.rpm	6119d24d7d4e0d51d56a8941f4ddfc10255735214d9c31ca5fba2a431f4db877
x86_64	v8-13.6-devel-13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1.x86_64.rpm	633f791ef784cf5375c8607911aec870734faa9a843a67d033cdcf25b5e6c017
x86_64	nodejs-24.22.1-1.module_el8.10.0+4331+0683c9c1.x86_64.rpm	6cfd3486d64439feb8fce8c3243956a9e7ee43c04230b8eedc3089547064f0cb
x86_64	nodejs-libs-24.22.1-1.module_el8.10.0+4331+0683c9c1.x86_64.rpm	f40c8b6c18eefb70a09c74f4aa5ec2778dae9a3d6829ae764b16702f938c19ad

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is ALSA-2026:92376?

It is AlmaLinux's Node.js 24 module erratum for AlmaLinux 8, fixing 13 CVEs including CVE-2026-101911 (unbounded IPv6 address parsing DoS), CVE-2026-111497 (the Brotli decoder buffer overflow, rated Critical 9.2 by NVD), and CVE-2026-105483/105482/106069 among others. Aggregate CVSS 6.3 (CWE-400).

Is this the same fix as the EasyApache Node advisory?

Yes — it is the same upstream Node.js October security wave (including the Brotli fix) delivered through AlmaLinux's nodejs:24 module for non-EasyApache servers. EasyApache 4 shipped it as 25.92; this module serves servers managing Node via the OS package.

How do I apply the fix?

Run dnf update nodejs (within the nodejs:24 module) and restart your Node.js applications so they run the patched runtime; verify with node --version.

Do I need this if I already applied EasyApache 25.92?

Only if you ALSO run Node from the AlmaLinux module alongside EasyApache-managed Node — the module package and the EA package are separate installs. Check which one serves your applications and keep that one patched.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen