Threats Tagged 'cve-2026-9675'

Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.29 release is based on Eclipse Che 7.119 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2. Users still using the v1 standard should migrate as soon as possible. https://devfile.io/docs/2.2.0/migrating-to-devfile-v2 Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates. https://access.redhat.com/support/policy/updates/openshift#crw

Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.29 release is based on Eclipse Che 7.119 and uses the DevWorkspace engine to provide support for workspaces based on devfile v2.1 and v2.2. Users still using the v1 standard should migrate as soon as possible. https://devfile.io/docs/2.2.0/migrating-to-devfile-v2 Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are expected to update to supported OpenShift releases in order to continue to get Dev Spaces updates. https://access.redhat.com/support/policy/updates/openshift#crw

This update includes the following RPMs: nodejs24: * nodejs24-24.16.0-1.hum1 (aarch64, x86_64) * nodejs24-bin-24.16.0-1.hum1 (noarch) * nodejs24-devel-24.16.0-1.hum1 (aarch64, x86_64) * nodejs24-docs-24.16.0-1.hum1 (noarch) * nodejs24-full-i18n-24.16.0-1.hum1 (aarch64, x86_64) * nodejs24-libs-24.16.0-1.hum1 (aarch64, x86_64) * nodejs24-npm-11.13.0-1.24.16.0.1.hum1 (noarch) * nodejs24-npm-bin-24.16.0-1.hum1 (noarch) * v8-13.6-devel-13.6.233.17-1.24.16.0.1.hum1 (aarch64, x86_64) * nodejs24-24.16.0-1.hum1.src (src)

This update includes the following RPMs:

This update for nodejs22 fixes the following issues: Update to 22.22.0: - CVE-2025-55130: file system permissions bypass via crafted symlinks (bsc#1256569). - CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570). - CVE-2025-55132: a file's access and modification timestamps can be changed via `futimes()` even when the process has only read permissions (bsc#1256571). - CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573). - CVE-2025-59466: uncatchable "Maximum call stack size exceeded" error when `async_hooks.createHook()` is enabled can lead to crash (bsc#1256574). - CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576). - CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848). For full changelog, please see https://nodejs.org/en/blog