ALSA-2026:7670
ALSA-2026:7670 · Important: nodejs:24 security update
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Nodejs denial of service (CVE-2026-21637) * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581) * undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527) * undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526) * undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229) * undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525) * undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528) * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712) * Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710) * Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715) * nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716) * Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711) * Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713) * Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714) * nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
nodejs AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 1:24.14.1-2.module_el8.10.0+4160+4819ac42
Mettez à jour vers 1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-devel AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 1:24.14.1-2.module_el8.10.0+4160+4819ac42
Mettez à jour vers 1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-docs AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 1:24.14.1-2.module_el8.10.0+4160+4819ac42
Mettez à jour vers 1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-full-i18n AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 1:24.14.1-2.module_el8.10.0+4160+4819ac42
Mettez à jour vers 1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-libs AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 1:24.14.1-2.module_el8.10.0+4160+4819ac42
Mettez à jour vers 1:24.14.1-2.module_el8.10.0+4160+4819ac42
nodejs-nodemon AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 3.0.3-1.module_el8.10.0+4061+f8ceeab9
Mettez à jour vers 3.0.3-1.module_el8.10.0+4061+f8ceeab9
nodejs-packaging AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 2021.06-6.module_el8.10.0+4086+70facd4a
Mettez à jour vers 2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 2021.06-6.module_el8.10.0+4086+70facd4a
Mettez à jour vers 2021.06-6.module_el8.10.0+4086+70facd4a
npm AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
Mettez à jour vers 1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42
v8-13.6-devel AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
Mettez à jour vers 3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42
Sources originales
- https://access.redhat.com/errata/RHSA-2026:7670
- https://access.redhat.com/security/cve/CVE-2026-1525
- https://access.redhat.com/security/cve/CVE-2026-1526
- https://access.redhat.com/security/cve/CVE-2026-1527
- https://access.redhat.com/security/cve/CVE-2026-1528
- https://access.redhat.com/security/cve/CVE-2026-21637
- https://access.redhat.com/security/cve/CVE-2026-21710
- https://access.redhat.com/security/cve/CVE-2026-21711
- https://access.redhat.com/security/cve/CVE-2026-21712
- https://access.redhat.com/security/cve/CVE-2026-21713
- https://access.redhat.com/security/cve/CVE-2026-21714
- https://access.redhat.com/security/cve/CVE-2026-21715
- https://access.redhat.com/security/cve/CVE-2026-21716
- https://access.redhat.com/security/cve/CVE-2026-21717
- https://access.redhat.com/security/cve/CVE-2026-2229
- https://access.redhat.com/security/cve/CVE-2026-2581
- https://access.redhat.com/security/cve/CVE-2026-26996
- https://access.redhat.com/security/cve/CVE-2026-27135
- https://bugzilla.redhat.com/2431340
- https://bugzilla.redhat.com/2441268
- https://bugzilla.redhat.com/2447140
- https://bugzilla.redhat.com/2447141
- https://bugzilla.redhat.com/2447142
- https://osv.dev/vulnerability/ALSA-2026:7670