Nodejs:24 Security Update — AlmaLinux 8 (ALSA-2026:62583)
ALSA-2026:62583 updates the Node.js 24 module on AlmaLinux 8, fixing three vulnerabilities (CVE-2026-58043, CVE-2026-56846, CVE-2026-56848) led by unauthorized filesystem access (CWE-284, aggregate CVSS 8.4). Update with dnf update nodejs within the nodejs:24 module and restart Node.js applications so they run the patched runtime.
SharedLicense लाइसेंस के तहत इसका अर्थ
Improper-access-control flaws (CWE-284) in the filesystem layer let code running inside Node reach files or paths the application should never touch — in hosting environments that crosses tenant boundaries.
Type:
security
Severity:
important
Release date:
2026-10-26
Description:
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
- CVE-2026-56846
- CVE-2026-56848
- CVE-2026-58043
- CVE-2026-56847
- CVE-2026-56850
- CVE-2026-58039
- CVE-2026-58040
- CVE-2026-58041
- CVE-2026-58042
- CVE-2026-58044
- CVE-2026-58045
- RHSA-2026:62583
- ALSA-2026:62583
Updated packages listed below:
| Architecture | Package | Checksum |
| aarch64 | nodejs-devel-24.19.0-1.module_el8.10.0+4268+8e07aa5a.aarch64.rpm | 047c0a7b14e6337311b9dad2caa28bd3152fd92f3ce571dc350e5e92f0315abc |
| aarch64 | nodejs-full-i18n-24.19.0-1.module_el8.10.0+4268+8e07aa5a.aarch64.rpm | 1a8c7f2a2c1180f0c4da10a890d5b5e55a919cc2c59ab4b170181178ccd2cc6e |
| aarch64 | nodejs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.aarch64.rpm | 1cd38cf3021a8ec89697f9a82d7f5cf4549ced5fb000f9b21e8f58beb7fe3518 |
| aarch64 | nodejs-libs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.aarch64.rpm | 1f4d48f4e7e1e069fe42e4301e36a60aaa2757997b1dc3dc76f3b9dcc1d9e836 |
| aarch64 | v8-13.6-devel-13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a.aarch64.rpm | 4d61fa6fd5a9a2a95834d18f0d35a53eeb5f108d73bc8f8f3aa89ffaa8925e9f |
| noarch | nodejs-packaging-2021.06-6.module_el8.10.0+4086+70facd4a.noarch.rpm | 318c493f93f2190506361306b5759e5e65eee18e3a8d85b195c800d8b7064bc0 |
| noarch | npm-11.17.0-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a.noarch.rpm | 4b9bd0ff598bba7c8bcc1148855160dfe7ace30fa9b167175f62a82928d0ee8f |
| noarch | nodejs-docs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.noarch.rpm | 6c4d51daf6e4dbf2019a3f1be79e3a90c384f898517c307bf616edccf624ab4d |
| noarch | nodejs-nodemon-3.1.14-2.module_el8.10.0+4250+09238ed4.noarch.rpm | 9af610bfd34078e749211d051d0a58ec3936da900b69e735bc529b46435cf37f |
| noarch | nodejs-packaging-bundler-2021.06-6.module_el8.10.0+4086+70facd4a.noarch.rpm | f4b4a25dc07327deb51619715aae6bd35d22e29ccfc97141c0b61de3a1995eee |
| ppc64le | nodejs-libs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.ppc64le.rpm | 0d4a912495c44f5d033ce9f9a7bf9af65994c4f5cff19e67dd6f1c761ff5e938 |
| ppc64le | v8-13.6-devel-13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a.ppc64le.rpm | 1e11e8232ee1dae61236c4bb4ff838bd697152eef785665b0448bc77851afed9 |
| ppc64le | nodejs-full-i18n-24.19.0-1.module_el8.10.0+4268+8e07aa5a.ppc64le.rpm | 4ea128862daf00db2962c7a1edbb2c5c4af973baf1c5981b2bb06d2e19785afb |
| ppc64le | nodejs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.ppc64le.rpm | 6a5460d46c65c134232390d2fc6c5896eae74f2bf6f1d0b99a048421d487d257 |
| ppc64le | nodejs-devel-24.19.0-1.module_el8.10.0+4268+8e07aa5a.ppc64le.rpm | 77fbde88b8d54a81eedbc10dd7abda93e80f0daf0c6652f24fee1dd6c10c3dba |
| s390x | nodejs-devel-24.19.0-1.module_el8.10.0+4268+8e07aa5a.s390x.rpm | 63372b4634d126e3fb1d68688ffccfe8c043fb8adf04e80fb26e455ea2e878cc |
| s390x | nodejs-full-i18n-24.19.0-1.module_el8.10.0+4268+8e07aa5a.s390x.rpm | 6d655cec2666c0e276fe86ebe931a399aeeebea639bfe126250cb02ddb75c82d |
| s390x | v8-13.6-devel-13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a.s390x.rpm | 76817ba5da389337370804fc9609b50aa27936a9295f6bd44c567c34fdbc5a77 |
| s390x | nodejs-libs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.s390x.rpm | 8afae18783ef2c6dcec17c07ff938e886c634e921bc0ad70ca3011a6cad6c067 |
| s390x | nodejs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.s390x.rpm | a8f179690895e20488936b9358e10d220cd23b47d1ff2ac8903a06ec8b6bd3bf |
| x86_64 | v8-13.6-devel-13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a.x86_64.rpm | 0c48d2e8a4d35d0d26977f355cb4926cae9437a5cdca2d3b45b8d81a27708f73 |
| x86_64 | nodejs-devel-24.19.0-1.module_el8.10.0+4268+8e07aa5a.x86_64.rpm | 3f874825329fdc045489900dcd0283ec8c61d747a5284c6cb6183d93b778cc7e |
| x86_64 | nodejs-full-i18n-24.19.0-1.module_el8.10.0+4268+8e07aa5a.x86_64.rpm | 79a3cfe95e1754123dcdb10efb2f34ef720366e0a2eaf7d8fcfe7fd8079c4627 |
| x86_64 | nodejs-libs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.x86_64.rpm | 855358251129b50020ea76b07b3b1e04d9d6e56264675f84f0b7007604be3bcb |
| x86_64 | nodejs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.x86_64.rpm | ed97d9fcd9e6527f8d3e41ea324f23b6066614f49d0a223e1018d0e3909cc1b4 |
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.
अक्सर पूछे जाने वाले प्रश्न
What is ALSA-2026:62583?
Who is affected?
How do I apply the fix?
What does unauthorized filesystem access mean in practice?
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें