Описание
ELSA-2026-92376: nodejs:24 security, bug fix, and enhancement update (IMPORTANT)
nodejs [1:24.21.0-1.0.1]
- Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497]
- Expose the decoder block-switch error and add regression coverage
- Require the patched system Brotli for shared builds
nodejs-nodemon nodejs-packaging
Обновленные пакеты
Oracle Linux 8
Oracle Linux aarch64
Module nodejs:24 is enabled
nodejs
24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5
nodejs-devel
24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5
nodejs-docs
24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5
nodejs-full-i18n
24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5
nodejs-libs
24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5
nodejs-nodemon
3.1.14-2.module+el8.10.0+91054+4b1a799c
nodejs-packaging
2021.06-6.module+el8.10.0+91054+4b1a799c
nodejs-packaging-bundler
2021.06-6.module+el8.10.0+91054+4b1a799c
npm
11.19.0-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5
v8-13.6-devel
13.6.233.17-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5
Oracle Linux x86_64
Module nodejs:24 is enabled
nodejs
24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5
nodejs-devel
24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5
nodejs-docs
24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5
nodejs-full-i18n
24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5
nodejs-libs
24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5
nodejs-nodemon
3.1.14-2.module+el8.10.0+91054+4b1a799c
nodejs-packaging
2021.06-6.module+el8.10.0+91054+4b1a799c
nodejs-packaging-bundler
2021.06-6.module+el8.10.0+91054+4b1a799c
npm
11.19.0-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5
v8-13.6-devel
13.6.233.17-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5
Ссылки на источники
Связанные уязвимости
ELSA-2026-92378: nodejs:24 security, bug fix, and enhancement update (IMPORTANT)
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.