ALSA-2026:92376
ALSA-2026:92376 · Important: nodejs:24 security, bug fix, and enhancement update
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911) * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483) * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069) * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482) * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074) * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071) * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481) * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073) * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072) Bug Fix(es) and Enhancement(s): * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
nodejs AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
Mettez à jour vers 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-devel AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
Mettez à jour vers 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-docs AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
Mettez à jour vers 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-full-i18n AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
Mettez à jour vers 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-libs AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
Mettez à jour vers 1:24.22.1-1.module_el8.10.0+4331+0683c9c1
nodejs-nodemon AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 3.1.14-2.module_el8.10.0+4250+09238ed4
Mettez à jour vers 3.1.14-2.module_el8.10.0+4250+09238ed4
nodejs-packaging AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 2021.06-6.module_el8.10.0+4086+70facd4a
Mettez à jour vers 2021.06-6.module_el8.10.0+4086+70facd4a
nodejs-packaging-bundler AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 2021.06-6.module_el8.10.0+4086+70facd4a
Mettez à jour vers 2021.06-6.module_el8.10.0+4086+70facd4a
npm AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
Mettez à jour vers 1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
v8-13.6-devel AlmaLinux:8
- Plages de versions concernées
- ECOSYSTEM: < 3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
Mettez à jour vers 3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1
Sources originales
- https://access.redhat.com/errata/RHSA-2026:92376
- https://access.redhat.com/security/cve/CVE-2026-101911
- https://access.redhat.com/security/cve/CVE-2026-102276
- https://access.redhat.com/security/cve/CVE-2026-102277
- https://access.redhat.com/security/cve/CVE-2026-102278
- https://access.redhat.com/security/cve/CVE-2026-105481
- https://access.redhat.com/security/cve/CVE-2026-105482
- https://access.redhat.com/security/cve/CVE-2026-105483
- https://access.redhat.com/security/cve/CVE-2026-106069
- https://access.redhat.com/security/cve/CVE-2026-106071
- https://access.redhat.com/security/cve/CVE-2026-106072
- https://access.redhat.com/security/cve/CVE-2026-106073
- https://access.redhat.com/security/cve/CVE-2026-106074
- https://access.redhat.com/security/cve/CVE-2026-111497
- https://bugzilla.redhat.com/2542596
- https://bugzilla.redhat.com/2542700
- https://bugzilla.redhat.com/2542706
- https://bugzilla.redhat.com/2542707
- https://bugzilla.redhat.com/2558973
- https://bugzilla.redhat.com/2559870
- https://bugzilla.redhat.com/2559873
- https://bugzilla.redhat.com/2559875
- https://bugzilla.redhat.com/2560016
- https://osv.dev/vulnerability/ALSA-2026:92376