Вернуться к предупреждениям о безопасности

Nodejs:24 Security Update — AlmaLinux 8 (ALSA-2026:62583)

ALSA-2026:62583 updates the Node.js 24 module on AlmaLinux 8, fixing three vulnerabilities (CVE-2026-58043, CVE-2026-56846, CVE-2026-56848) led by unauthorized filesystem access (CWE-284, aggregate CVSS 8.4). Update with dnf update nodejs within the nodejs:24 module and restart Node.js applications so they run the patched runtime.

High 8.4 CVSS 2026-10-26

AlmaLinux 8

Что это значит по лицензии SharedLicense

Improper-access-control flaws (CWE-284) in the filesystem layer let code running inside Node reach files or paths the application should never touch — in hosting environments that crosses tenant boundaries.

Type:

security

Severity:

important

Release date:

2026-10-26

Description:

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	nodejs-devel-24.19.0-1.module_el8.10.0+4268+8e07aa5a.aarch64.rpm	047c0a7b14e6337311b9dad2caa28bd3152fd92f3ce571dc350e5e92f0315abc
aarch64	nodejs-full-i18n-24.19.0-1.module_el8.10.0+4268+8e07aa5a.aarch64.rpm	1a8c7f2a2c1180f0c4da10a890d5b5e55a919cc2c59ab4b170181178ccd2cc6e
aarch64	nodejs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.aarch64.rpm	1cd38cf3021a8ec89697f9a82d7f5cf4549ced5fb000f9b21e8f58beb7fe3518
aarch64	nodejs-libs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.aarch64.rpm	1f4d48f4e7e1e069fe42e4301e36a60aaa2757997b1dc3dc76f3b9dcc1d9e836
aarch64	v8-13.6-devel-13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a.aarch64.rpm	4d61fa6fd5a9a2a95834d18f0d35a53eeb5f108d73bc8f8f3aa89ffaa8925e9f
noarch	nodejs-packaging-2021.06-6.module_el8.10.0+4086+70facd4a.noarch.rpm	318c493f93f2190506361306b5759e5e65eee18e3a8d85b195c800d8b7064bc0
noarch	npm-11.17.0-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a.noarch.rpm	4b9bd0ff598bba7c8bcc1148855160dfe7ace30fa9b167175f62a82928d0ee8f
noarch	nodejs-docs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.noarch.rpm	6c4d51daf6e4dbf2019a3f1be79e3a90c384f898517c307bf616edccf624ab4d
noarch	nodejs-nodemon-3.1.14-2.module_el8.10.0+4250+09238ed4.noarch.rpm	9af610bfd34078e749211d051d0a58ec3936da900b69e735bc529b46435cf37f
noarch	nodejs-packaging-bundler-2021.06-6.module_el8.10.0+4086+70facd4a.noarch.rpm	f4b4a25dc07327deb51619715aae6bd35d22e29ccfc97141c0b61de3a1995eee
ppc64le	nodejs-libs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.ppc64le.rpm	0d4a912495c44f5d033ce9f9a7bf9af65994c4f5cff19e67dd6f1c761ff5e938
ppc64le	v8-13.6-devel-13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a.ppc64le.rpm	1e11e8232ee1dae61236c4bb4ff838bd697152eef785665b0448bc77851afed9
ppc64le	nodejs-full-i18n-24.19.0-1.module_el8.10.0+4268+8e07aa5a.ppc64le.rpm	4ea128862daf00db2962c7a1edbb2c5c4af973baf1c5981b2bb06d2e19785afb
ppc64le	nodejs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.ppc64le.rpm	6a5460d46c65c134232390d2fc6c5896eae74f2bf6f1d0b99a048421d487d257
ppc64le	nodejs-devel-24.19.0-1.module_el8.10.0+4268+8e07aa5a.ppc64le.rpm	77fbde88b8d54a81eedbc10dd7abda93e80f0daf0c6652f24fee1dd6c10c3dba
s390x	nodejs-devel-24.19.0-1.module_el8.10.0+4268+8e07aa5a.s390x.rpm	63372b4634d126e3fb1d68688ffccfe8c043fb8adf04e80fb26e455ea2e878cc
s390x	nodejs-full-i18n-24.19.0-1.module_el8.10.0+4268+8e07aa5a.s390x.rpm	6d655cec2666c0e276fe86ebe931a399aeeebea639bfe126250cb02ddb75c82d
s390x	v8-13.6-devel-13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a.s390x.rpm	76817ba5da389337370804fc9609b50aa27936a9295f6bd44c567c34fdbc5a77
s390x	nodejs-libs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.s390x.rpm	8afae18783ef2c6dcec17c07ff938e886c634e921bc0ad70ca3011a6cad6c067
s390x	nodejs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.s390x.rpm	a8f179690895e20488936b9358e10d220cd23b47d1ff2ac8903a06ec8b6bd3bf
x86_64	v8-13.6-devel-13.6.233.17-1.24.19.0.1.module_el8.10.0+4268+8e07aa5a.x86_64.rpm	0c48d2e8a4d35d0d26977f355cb4926cae9437a5cdca2d3b45b8d81a27708f73
x86_64	nodejs-devel-24.19.0-1.module_el8.10.0+4268+8e07aa5a.x86_64.rpm	3f874825329fdc045489900dcd0283ec8c61d747a5284c6cb6183d93b778cc7e
x86_64	nodejs-full-i18n-24.19.0-1.module_el8.10.0+4268+8e07aa5a.x86_64.rpm	79a3cfe95e1754123dcdb10efb2f34ef720366e0a2eaf7d8fcfe7fd8079c4627
x86_64	nodejs-libs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.x86_64.rpm	855358251129b50020ea76b07b3b1e04d9d6e56264675f84f0b7007604be3bcb
x86_64	nodejs-24.19.0-1.module_el8.10.0+4268+8e07aa5a.x86_64.rpm	ed97d9fcd9e6527f8d3e41ea324f23b6066614f49d0a223e1018d0e3909cc1b4

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Часто задаваемые вопросы

What is ALSA-2026:62583?

It is AlmaLinux's erratum for the Node.js 24 module on AlmaLinux 8, fixing three CVEs (CVE-2026-58043, CVE-2026-56846, CVE-2026-56848) — unauthorized filesystem access among them (CWE-284 improper access control), at aggregate CVSS 8.4.

Who is affected?

AlmaLinux 8 servers running Node.js applications through the nodejs:24 module — application code that handles file paths or user uploads is the exposed surface.

How do I apply the fix?

Run dnf update nodejs (within the nodejs:24 module stream), then restart your Node.js applications so the patched runtime is loaded — verify with node --version.

What does unauthorized filesystem access mean in practice?

The runtime fails to properly restrict which paths operations may touch — so a bug or malicious package inside your app can read or write outside its intended directory. Combined with multi-tenant hosting, that makes the runtime update part of tenant isolation.

Источники

Предупреждения о безопасности

Проверьте систему на уязвимости

Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.

Проверьте свою систему

Часто задаваемые вопросы

Похожие предупреждения

Проверьте систему на уязвимости