Nodejs22 Security Update — AlmaLinux 10 (ALSA-2026:96094)
ALSA-2026:96094 updates the Node.js 22 module on AlmaLinux 10, fixing eight CVEs in the runtime and its bundled dependencies. Aggregate CVSS 7.5. Update with dnf update nodejs within the nodejs:22 module and restart Node.js applications so they run the patched runtime.
SharedLicense लाइसेंस के तहत इसका अर्थ
Node.js 22 is the current LTS line — memory-safety and request-handling flaws there are remotely reachable in every LTS-based application on the server.
Type:
security
Severity:
important
Release date:
2026-11-10
Description:
Node.js is a platform built on Chrome’s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.
Security Fix(es):
* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)
* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)
* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)
* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)
* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
- CVE-2026-102276
- CVE-2026-102278
- CVE-2026-105482
- CVE-2026-106069
- CVE-2026-109383
- CVE-2026-109829
- CVE-2026-109869
- CVE-2026-87018
- RHSA-2026:96094
- ALSA-2026:96094
Updated packages listed below:
| Architecture | Package | Checksum |
| aarch64 | nodejs-22.23.4-1.el10_2.aarch64.rpm | 573aeb71799905b0544055b30af36724de8a975821f8a625c1093a968463b61b |
| aarch64 | nodejs-npm-10.9.9-1.22.23.4.1.el10_2.aarch64.rpm | 5b352b18d5307e161afc92b7c28276c3aaa00b2c5bda371020375cd7b793c856 |
| aarch64 | nodejs-full-i18n-22.23.4-1.el10_2.aarch64.rpm | 7ef59145cadd85a2e953be44378de411b3ac700821d5d397f40a7ea2eb266a2f |
| aarch64 | nodejs-devel-22.23.4-1.el10_2.aarch64.rpm | 8c37bf5bbea621c7d3fbbab99b2354c6e9a39145ddec34f2d623d5c24709d326 |
| aarch64 | nodejs-libs-22.23.4-1.el10_2.aarch64.rpm | a370c3b4f0d81cd733510f46f83fd37e3ec180d88b59312aef4ee68d23572eae |
| noarch | nodejs-docs-22.23.4-1.el10_2.noarch.rpm | 39d9aa7d883d3f5c1857231b2f0a39b6312248e03c5a9b8b65d97abf3ba7a725 |
| ppc64le | nodejs-libs-22.23.4-1.el10_2.ppc64le.rpm | 02394d90dd928c0a12fe18c27bbc19a73ca3fc37feae46bcc3cf6f7be7fff8ee |
| ppc64le | nodejs-devel-22.23.4-1.el10_2.ppc64le.rpm | 937887ad0d81eef46ca13116db364748b132885712720e347e3247c160c070ea |
| ppc64le | nodejs-full-i18n-22.23.4-1.el10_2.ppc64le.rpm | b73789f4022c0f7a72300b07cdd05f01160228edbf94db6859c823c9289cb1b6 |
| ppc64le | nodejs-npm-10.9.9-1.22.23.4.1.el10_2.ppc64le.rpm | cd79b394d90d6897cfb46f81a84e682d4bbaabb70e0a0a19fb8d464f76352119 |
| ppc64le | nodejs-22.23.4-1.el10_2.ppc64le.rpm | e4f5d50ae4af0993a3f8be5311c5cd0689e9140ef52f22be03c8e3b9a6f295e5 |
| s390x | nodejs-libs-22.23.4-1.el10_2.s390x.rpm | 067d5de1908f9fd5ba2c6f7146646bf82827d5546f2f6725d676179069d30d19 |
| s390x | nodejs-full-i18n-22.23.4-1.el10_2.s390x.rpm | 4254c54745de805bff9c9317eccf18c536ae7a8cc1aaacb82b2b9967fe6a07b6 |
| s390x | nodejs-22.23.4-1.el10_2.s390x.rpm | 469bd6280a2b2a67b6a16187a9b7cf3d95844c8cfcdb998d865f1ac4532c2c7f |
| s390x | nodejs-devel-22.23.4-1.el10_2.s390x.rpm | 89ce833c890f183afd0bbf3f3fb258db8062b96cab16fbfc80b635a8c8351269 |
| s390x | nodejs-npm-10.9.9-1.22.23.4.1.el10_2.s390x.rpm | ce06f65fef1a17a5ac773afd74689343a7385680408e6f4d7baea119c1db5447 |
| x86_64 | nodejs-22.23.4-1.el10_2.x86_64.rpm | 37758949d2ab4f7d2b41ef5863844ba1a01031f5949105553d96ecbfc6d5c912 |
| x86_64 | nodejs-npm-10.9.9-1.22.23.4.1.el10_2.x86_64.rpm | 4ac956e68bd5399224ea3b9fe0a4dcc23bccb4708efb333132bedbadb6852a6f |
| x86_64 | nodejs-libs-22.23.4-1.el10_2.x86_64.rpm | 673003a1e8b34a42166c7336a8225d5157e539050c4974229e3248e38ff965ff |
| x86_64 | nodejs-full-i18n-22.23.4-1.el10_2.x86_64.rpm | a988f30099bc622c2d152e8ef8a018a8e6da7c6c01c2b3e9cd56614e2084a9ca |
| x86_64 | nodejs-devel-22.23.4-1.el10_2.x86_64.rpm | b54084c87003ed57588bc390ce3cde61cb73a26a91a9e6da5b064fba2de54b55 |
| x86_64_v2 | nodejs-libs-22.23.4-1.el10_2.x86_64_v2.rpm | 075e49a94a735563fceb9064ebac018526e55e51ed57c18bca8de8f83bd74692 |
| x86_64_v2 | nodejs-devel-22.23.4-1.el10_2.x86_64_v2.rpm | 8681af3ef50d2aafe7c4e1aadbdf426ff2a884087a8eb25ecefdabd758fae0e0 |
| x86_64_v2 | nodejs-full-i18n-22.23.4-1.el10_2.x86_64_v2.rpm | ee281671b5d8c032dc46a44fca828ffb24145d912112332cca7c618da4f9484d |
| x86_64_v2 | nodejs-npm-10.9.9-1.22.23.4.1.el10_2.x86_64_v2.rpm | f166c8ac88b5d6707215f165957646c507e96e7cdc4390b6f72eab0148061b5c |
| x86_64_v2 | nodejs-22.23.4-1.el10_2.x86_64_v2.rpm | f3b5f8b34b79ceb6ec923b7c58d27047fa828b53770bd2b6586aa050a1985a91 |
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.
अक्सर पूछे जाने वाले प्रश्न
What is ALSA-2026:96094?
Who is affected?
How do I apply the fix?
Is Node 22 different from the Node 24 erratum?
संदर्भ
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें