Threats Tagged 'cve-2026-21636'

This update includes the following RPMs:

Multiple security vulnerabilities have been identified in the Node.js 22 package distributed with Red Hat Enterprise Linux 10.0 Extended Update Support. These include a denial of service, uninitialized memory exposure, and file permissions bypass issues. Red Hat has issued an important security advisory (RHSA-2026:2899) addressing these vulnerabilities with updated packages. The vulnerabilities affect Node.js 22.22.0-1.el10_0 across multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS scores are provided in the advisory. The update is available and should be applied to remediate these issues.

A critical flaw in Node.js version 25's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when the --permission flag is enabled. This vulnerability permits attacker-controlled inputs to connect to arbitrary local sockets even without the --allow-net permission, breaking the intended security boundary. This can lead to privilege escalation, data exposure, or local code execution. The issue affects Node.js versions from 25.0.0 up to but not including 25.3.0. A patch is available for this vulnerability.

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

Node.js version 25.2.1 contains a vulnerability in its permission model that allows Unix Domain Socket (UDS) connections to bypass network restrictions when the --permission flag is enabled. This flaw permits attacker-controlled inputs to connect to arbitrary local sockets even without the --allow-net permission, breaking the intended security boundary. The issue can lead to unauthorized access to privileged local services, potentially resulting in privilege escalation or data exposure. The network permissions feature was still experimental at the time of this vulnerability.