{"schema_version": "1.7.0", "id": "RLSA-2026:7675", "modified": "2026-04-15T12:09:44.433238Z", "published": "2026-04-15T12:07:10.074197Z", "upstream": ["CVE-2026-1525", "CVE-2026-1526", "CVE-2026-1527", "CVE-2026-1528", "CVE-2026-21637", "CVE-2026-21710", "CVE-2026-21711", "CVE-2026-21712", "CVE-2026-21713", "CVE-2026-21714", "CVE-2026-21715", "CVE-2026-21716", "CVE-2026-21717", "CVE-2026-2229", "CVE-2026-25547", "CVE-2026-2581", "CVE-2026-26996", "CVE-2026-27135"], "summary": "Important: nodejs24 security update", "details": "Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Nodejs denial of service (CVE-2026-21637)\n\n* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)\n\n* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)\n\n* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)\n\n* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)\n\n* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)\n\n* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)\n\n* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)\n\n* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)\n\n* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)\n\n* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)\n\n* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)\n\n* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)\n\n* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)\n\n* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)\n\n* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)\n\n* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)\n\n* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "severity": [{"type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}], "affected": [{"package": {"ecosystem": "Rocky Linux:10", "name": "nodejs24", "purl": "pkg:rpm/rocky-linux/nodejs24?distro=rocky-linux-10&epoch=1"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "1:24.14.1-2.el10_1"}], "database_specific": {"yum_repository": "AppStream"}}]}], "references": [{"type": "ADVISORY", "url": "https://errata.rockylinux.org/RLSA-2026:7675"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453162"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447142"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453160"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447140"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453161"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436942"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453151"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453037"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447141"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453158"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453157"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453152"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441268"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431340"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447145"}], "credits": [{"name": "Rocky Enterprise Software Foundation"}, {"name": "Red Hat"}]}