Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)
* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* nodejs: Nodejs denial of service (CVE-2026-21637)
* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)
* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)
* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)
* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)
* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)
* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)
* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)
* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)
* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)
* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)
* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)
* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)
* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)
* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)
* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)
* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)
* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update for Node.js 20 on Red Hat Enterprise Linux 9.4 addresses multiple vulnerabilities including denial of service, uninitialized memory exposure, and file permissions bypass. These issues could impact the security of applications running Node.js on affected Red Hat platforms. The update is rated as important by Red Hat Product Security and fixes several CVEs. Users of the affected Red Hat Enterprise Linux 9.4 Extended Update Support versions should apply the update to mitigate these vulnerabilities.
A security update for Node.js 20 on Red Hat Enterprise Linux 9 addresses multiple vulnerabilities, including a remote crash issue via SignTraits::DeriveBits() (CVE-2025-23166). The update is rated as important by Red Hat Product Security and affects various architectures and extended update support versions of Red Hat Enterprise Linux 9. A patch is available to remediate these issues.
A security vulnerability (CVE-2025-23083) affecting Node.js 20 has been identified and addressed by Red Hat. The issue involves exposure of Node.js Worker Threads via the Diagnostics Channel. Red Hat has released an important security update for Node.js 20 on Red Hat Enterprise Linux 9.4 Extended Update Support. The advisory provides updated packages to remediate this vulnerability.
Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language.
Security Fix(es):
* nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)
* nodejs: CONTINUATION frames DoS (CVE-2024-27983)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* nodejs: CONTINUATION frames DoS (CVE-2024-27983)
* nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service (CVE-2024-22025)
* nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)
* nghttp2: CONTINUATION frames DoS (CVE-2024-28182)
* c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.