Red Hat Security Advisory: nodejs26 security, bug fix, and enhancement update
Affects Red Hat nodejs26 security,Source GCVE Database
Mentioned vulnerabilities
Not known to be exploited.
Data as of 11 Nov 2026, 10:02 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
Exploitation evidence
Disclosed: evidence found.
CVE published 11 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.
What to do
AI-suggested
Red Hat has released updated nodejs26 packages that address these vulnerabilities. Users should apply the nodejs26 update for Red Hat Enterprise Linux 10 as described in the Red Hat advisory RHSA-2026:98060 and the referenced update article https://access.redhat.com/articles/11258. Applying this update will remediate the authentication bypass, TLS validation bypass, and denial of service issues. No additional mitigation steps are indicated beyond applying the official update.
Description
Red Hat has issued a security advisory for nodejs26 on Red Hat Enterprise Linux 10 addressing three vulnerabilities in the undici HTTP client library. These include an authentication bypass via cross-origin cache poisoning (CVE-2026-85152), a TLS certificate validation bypass in BalancedPool due to dropped connect options (CVE-2026-84961), and a denial of service via an unrequested WebSocket subprotocol (CVE-2026-19534). The update rebases nodejs26 to the latest Node.js 26 release and includes bug fixes and enhancements. The vulnerabilities are rated as important by Red Hat Product Security. The advisory provides updated packages to remediate these issues.
References
- access.redhat.com/errata/RHSA-2026:98060 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2528717 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2528735 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2528759 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98060.json (opens in a new tab)