{"schema_version": "1.7.0", "id": "RLSA-2026:35892", "modified": "2026-07-07T00:07:08.456141Z", "published": "2026-07-07T00:03:33.974198Z", "upstream": ["CVE-2026-11525", "CVE-2026-12151", "CVE-2026-42338", "CVE-2026-48615", "CVE-2026-48618", "CVE-2026-48619", "CVE-2026-48928", "CVE-2026-48930", "CVE-2026-48933", "CVE-2026-48934", "CVE-2026-48935", "CVE-2026-6733", "CVE-2026-9678"], "summary": "Important: nodejs:22 security, bug fix, and enhancement update", "details": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)\n\n* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)\n\n* undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)\n\n* undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)\n\n* undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)\n\n* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)\n\n* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)\n\n* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)\n\n* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)\n\n* nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)\n\n* Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)\n\n* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)\n\n* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:Rocky Linux-186622)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "severity": [{"type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}], "affected": [{"package": {"ecosystem": "Rocky Linux:9", "name": "nodejs-nodemon", "purl": "pkg:rpm/rocky-linux/nodejs-nodemon?distro=rocky-linux-9-x86-64&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:3.0.1-1.module+el9.7.0+40165+d075e3f2"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:9", "name": "nodejs-nodemon", "purl": "pkg:rpm/rocky-linux/nodejs-nodemon?distro=rocky-linux-9-x86-64&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:3.0.1-1.module+el9.7.0+40022+9ecc286c"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:9", "name": "nodejs-nodemon", "purl": "pkg:rpm/rocky-linux/nodejs-nodemon?distro=rocky-linux-9-x86-64&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:3.0.1-1.module+el9.7.0+40153+4d595597"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:9", "name": "nodejs-packaging", "purl": "pkg:rpm/rocky-linux/nodejs-packaging?distro=rocky-linux-9-x86-64&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:2021.06-6.module+el9.7.0+40153+4d595597"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:9", "name": "nodejs-packaging", "purl": "pkg:rpm/rocky-linux/nodejs-packaging?distro=rocky-linux-9-x86-64&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:2021.06-6.module+el9.7.0+40165+d075e3f2"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:9", "name": "nodejs-packaging", "purl": "pkg:rpm/rocky-linux/nodejs-packaging?distro=rocky-linux-9-x86-64&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:2021.06-6.module+el9.7.0+40052+e32ea525"}], "database_specific": {"yum_repository": "AppStream"}}]}], "references": [{"type": "ADVISORY", "url": "https://errata.rockylinux.org/RLSA-2026:35892"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476810"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489980"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490000"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490006"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490008"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493325"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493326"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493329"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493331"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493332"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493333"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493335"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493337"}], "credits": [{"name": "Rocky Enterprise Software Foundation"}, {"name": "Red Hat"}]}