Вернуться к предупреждениям о безопасности

Nodejs24 Security Update — AlmaLinux 10 (ALSA-2026:96088)

ALSA-2026:96088 updates the Node.js 24 module on AlmaLinux 10, fixing nine CVEs in the runtime and its bundled dependencies. Aggregate CVSS 7.5. Update with dnf update nodejs within the nodejs:24 module and restart Node.js applications so they run the patched runtime.

High 7.5 CVSS
AlmaLinux 10

Что это значит по лицензии SharedLicense

Node.js runs untrusted-adjacent input through parsers and network handlers — memory-safety and request-handling flaws there are remotely reachable in every Node application on the server.

Type:

security

Severity:

important

Release date:

2026-11-10

Description:

Node.js is a platform built on Chrome’s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
* brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
* undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869)
* undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018)
* undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383)
* undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829)
* nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
* nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
* nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

Bug Fix(es) and Enhancement(s):

* nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-295759)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 nodejs24-full-i18n-24.22.1-3.el10_2.aarch64.rpm 44328df8777d70a41e0ca3819c339432f77d516904245a307c8f646be7cdb490
aarch64 nodejs24-devel-24.22.1-3.el10_2.aarch64.rpm 5343d239b2f4204a4d43cda73fecdc1e3a289af527ae0926ec2c827acf4dd758
aarch64 nodejs24-libs-24.22.1-3.el10_2.aarch64.rpm 7c6749cadde81a477c203c8e5b07ff86202b97f189692189bbb4317b7659c253
aarch64 nodejs24-24.22.1-3.el10_2.aarch64.rpm 8ac7da485f29ce55a5463b101e03862bfac903dc036ab59c465f57734565ee8a
noarch nodejs24-npm-11.19.1-1.24.22.1.3.el10_2.noarch.rpm 103131f57ec7a0989bf0b9f7c07569d87d3dcbecd878b23d85ffc6a303361273
noarch nodejs24-docs-24.22.1-3.el10_2.noarch.rpm 21878c1d48c17d23c42bbf60c95c7e0ad17076617f261310e7cc3850585f1e20
ppc64le nodejs24-libs-24.22.1-3.el10_2.ppc64le.rpm 07271d500d59d11f025680d07e1be105b6d9f4e8e9646f5781a377107ac1e7d1
ppc64le nodejs24-full-i18n-24.22.1-3.el10_2.ppc64le.rpm 2e874731b77a93d1fae7ebc854773f56b56865073d0ed4bd34a2ab11783916e6
ppc64le nodejs24-24.22.1-3.el10_2.ppc64le.rpm 5e567d12e9feb502d8be54dae9549933394b624eaf5ee62776578bae6fe594c3
ppc64le nodejs24-devel-24.22.1-3.el10_2.ppc64le.rpm 83d2ec631f25e19337e6546c739a82643e987f0f4520477fb8cdf7a0cc3bf91b
s390x nodejs24-24.22.1-3.el10_2.s390x.rpm 2146eca747f29e14f12bdb2df8d5ea70eb835a17bffb31bb9a8f4441f244364b
s390x nodejs24-devel-24.22.1-3.el10_2.s390x.rpm 93b86bb42f9aa4f5b6970f8a43e302277598eece4719f727bc9e08b43b9d80bf
s390x nodejs24-libs-24.22.1-3.el10_2.s390x.rpm 94cfad2fa471cefaa2d8b323bcc5ea85c02ce5745aeb7450308533cdac101fed
s390x nodejs24-full-i18n-24.22.1-3.el10_2.s390x.rpm f2da038009bc3cb0938ebe4a2cfafa2b1d8edebc2c8efe6167ab18c6dedad27b
x86_64 nodejs24-24.22.1-3.el10_2.x86_64.rpm 3c74cacd5a08fe8e91688f4230b45ea276b5f44e2a20b8230f8aa3443d151d8e
x86_64 nodejs24-devel-24.22.1-3.el10_2.x86_64.rpm 411c582ab748f72c20fd1b2750354bad55d9469e26600a8bf10f40fd8abd2a6a
x86_64 nodejs24-libs-24.22.1-3.el10_2.x86_64.rpm ca67ce8d46f272974cbea994ea3b7baff8f7089f36e3898ee9b2e46e7af06be0
x86_64 nodejs24-full-i18n-24.22.1-3.el10_2.x86_64.rpm d31cb9195b4d8fc8de9e9d65c9e6177c7e7f9f725b42d11be535d7392501f1df
x86_64_v2 nodejs24-24.22.1-3.el10_2.x86_64_v2.rpm 62fe38753f125f073484e0b0e7af86c4676f8d46a4f349ab2b5f73b232183bd7
x86_64_v2 nodejs24-libs-24.22.1-3.el10_2.x86_64_v2.rpm 986451f9baa10a33fa23300c8f46d6326e014ec6e281270a0e0d58239dbea24c
x86_64_v2 nodejs24-full-i18n-24.22.1-3.el10_2.x86_64_v2.rpm ad3a3a5bcf4ed04c106c4f3870363c661296a50c1a3eb04bf2a308d9b2b104b4
x86_64_v2 nodejs24-devel-24.22.1-3.el10_2.x86_64_v2.rpm c92f9ea8385db21f29ed634f6aaf4cd2408dcd0821248e0152c0cd8483a1c45c

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Часто задаваемые вопросы

What is ALSA-2026:96088?
It is AlmaLinux's Node.js 24 module erratum for AlmaLinux 10, fixing nine CVEs (CVE-2026-102278, CVE-2026-102276, CVE-2026-109869, CVE-2026-87018, CVE-2026-109383, CVE-2026-109829, CVE-2026-105483, CVE-2026-106069 and others) at aggregate CVSS 7.5.
Who is affected?
AlmaLinux 10 servers running Node.js 24 applications from the nodejs:24 module — APIs, web services and build tooling.
How do I apply the fix?
Run dnf update nodejs (within the nodejs:24 module) and restart your Node.js applications; verify with node --version reporting the updated build.
Why do Node.js batches arrive so frequently?
Node bundles dozens of third-party libraries (HTTP parsers, TLS, compression) — each upstream security wave re-arms the bundled set, so Node module errata ship close to every Node release.

Источники

Предупреждения о безопасности

Похожие предупреждения

Nodejs-Nodemon Security Update — AlmaLinux 10 (ALSA-2026:96236)

2026-11-10

Nodejs22 Security Update — AlmaLinux 10 (ALSA-2026:96094)

2026-11-10

Edk2 Security Update — AlmaLinux 10 (ALSA-2026:96240)

2026-11-10

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему