Описание
Important: nodejs:24 security, bug fix, and enhancement update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
-
ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
-
brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
-
brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
-
brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
-
brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
-
nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
-
nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
-
nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
-
nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
-
nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
-
nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
-
nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
-
nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
Bug Fix(es) and Enhancement(s):
- nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 9
Ссылки на источники
Исправления
- Red Hat - 2542596
- Red Hat - 2542700
- Red Hat - 2542706
- Red Hat - 2542707
- Red Hat - 2558973
- Red Hat - 2559870
- Red Hat - 2559873
- Red Hat - 2559875
- Red Hat - 2560016
- Red Hat - 2560018
- Red Hat - 2560019
- Red Hat - 2560021
- Red Hat - 2560022
Связанные уязвимости
ELSA-2026-92378: nodejs:24 security, bug fix, and enhancement update (IMPORTANT)
ELSA-2026-92376: nodejs:24 security, bug fix, and enhancement update (IMPORTANT)
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.