RHSA-2026:61377
Vulnerability from csaf_opensuse - Published: 2026-08-31 12:20 - Updated: 2026-10-08 23:10Summary
Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update
Severity
Important
Notes
Topic: An update for nodejs24 is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.
Security Fix(es):
* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)
Bug Fix(es) and Enhancement(s):
* nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-220543)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
31 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still executing.
7.5 (High)
Affected products
Fixed
31 products, the same list as for
CVE-2026-56846
Threats
Impact
Important
A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories.
7.5 (High)
Affected products
Fixed
31 products, the same list as for
CVE-2026-56846
Threats
Impact
Important
References
19 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for nodejs24 is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Node.js is a platform built on Chrome\u0027s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)\n\n* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)\n\n* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)\n\nBug Fix(es) and Enhancement(s):\n\n* nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-220543)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:61377",
"url": "https://access.redhat.com/errata/RHSA-2026:61377"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2509171",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509171"
},
{
"category": "external",
"summary": "2510856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510856"
},
{
"category": "external",
"summary": "RHEL-220543",
"url": "https://issues.redhat.com/browse/RHEL-220543"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61377.json"
}
],
"title": "Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-10-08T23:10:27+00:00",
"generator": {
"date": "2026-10-08T23:10:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:61377",
"initial_release_date": "2026-08-31T12:20:58+00:00",
"revision_history": [
{
"date": "2026-08-31T12:20:58+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-31T12:20:58+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-08T23:10:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs24-1:24.19.0-1.el10_2.src",
"product": {
"name": "nodejs24-1:24.19.0-1.el10_2.src",
"product_id": "nodejs24-1:24.19.0-1.el10_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24@24.19.0-1.el10_2?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs24-1:24.19.0-1.el10_2.aarch64",
"product": {
"name": "nodejs24-1:24.19.0-1.el10_2.aarch64",
"product_id": "nodejs24-1:24.19.0-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24@24.19.0-1.el10_2?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"product": {
"name": "nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"product_id": "nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-devel@24.19.0-1.el10_2?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"product": {
"name": "nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"product_id": "nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-full-i18n@24.19.0-1.el10_2?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"product": {
"name": "nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"product_id": "nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-libs@24.19.0-1.el10_2?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"product": {
"name": "nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"product_id": "nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-debugsource@24.19.0-1.el10_2?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"product": {
"name": "nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"product_id": "nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-debuginfo@24.19.0-1.el10_2?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"product": {
"name": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"product_id": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-libs-debuginfo@24.19.0-1.el10_2?arch=aarch64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs24-1:24.19.0-1.el10_2.ppc64le",
"product": {
"name": "nodejs24-1:24.19.0-1.el10_2.ppc64le",
"product_id": "nodejs24-1:24.19.0-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24@24.19.0-1.el10_2?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"product": {
"name": "nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"product_id": "nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-devel@24.19.0-1.el10_2?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"product": {
"name": "nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"product_id": "nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-full-i18n@24.19.0-1.el10_2?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"product": {
"name": "nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"product_id": "nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-libs@24.19.0-1.el10_2?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"product": {
"name": "nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"product_id": "nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-debugsource@24.19.0-1.el10_2?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"product": {
"name": "nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"product_id": "nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-debuginfo@24.19.0-1.el10_2?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"product": {
"name": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"product_id": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-libs-debuginfo@24.19.0-1.el10_2?arch=ppc64le\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs24-1:24.19.0-1.el10_2.s390x",
"product": {
"name": "nodejs24-1:24.19.0-1.el10_2.s390x",
"product_id": "nodejs24-1:24.19.0-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24@24.19.0-1.el10_2?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"product": {
"name": "nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"product_id": "nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-devel@24.19.0-1.el10_2?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"product": {
"name": "nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"product_id": "nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-full-i18n@24.19.0-1.el10_2?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"product": {
"name": "nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"product_id": "nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-libs@24.19.0-1.el10_2?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"product": {
"name": "nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"product_id": "nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-debugsource@24.19.0-1.el10_2?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"product": {
"name": "nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"product_id": "nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-debuginfo@24.19.0-1.el10_2?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"product": {
"name": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"product_id": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-libs-debuginfo@24.19.0-1.el10_2?arch=s390x\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs24-1:24.19.0-1.el10_2.x86_64",
"product": {
"name": "nodejs24-1:24.19.0-1.el10_2.x86_64",
"product_id": "nodejs24-1:24.19.0-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24@24.19.0-1.el10_2?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"product": {
"name": "nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"product_id": "nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-devel@24.19.0-1.el10_2?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"product": {
"name": "nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"product_id": "nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-full-i18n@24.19.0-1.el10_2?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"product": {
"name": "nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"product_id": "nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-libs@24.19.0-1.el10_2?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"product": {
"name": "nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"product_id": "nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-debugsource@24.19.0-1.el10_2?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"product": {
"name": "nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"product_id": "nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-debuginfo@24.19.0-1.el10_2?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"product": {
"name": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"product_id": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-libs-debuginfo@24.19.0-1.el10_2?arch=x86_64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"product": {
"name": "nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"product_id": "nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-docs@24.19.0-1.el10_2?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch",
"product": {
"name": "nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch",
"product_id": "nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nodejs24-npm@11.17.0-1.24.19.0.1.el10_2?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-1:24.19.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64"
},
"product_reference": "nodejs24-1:24.19.0-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-1:24.19.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le"
},
"product_reference": "nodejs24-1:24.19.0-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-1:24.19.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x"
},
"product_reference": "nodejs24-1:24.19.0-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-1:24.19.0-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src"
},
"product_reference": "nodejs24-1:24.19.0-1.el10_2.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-1:24.19.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64"
},
"product_reference": "nodejs24-1:24.19.0-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64"
},
"product_reference": "nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le"
},
"product_reference": "nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x"
},
"product_reference": "nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64"
},
"product_reference": "nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64"
},
"product_reference": "nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le"
},
"product_reference": "nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-debugsource-1:24.19.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x"
},
"product_reference": "nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64"
},
"product_reference": "nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-devel-1:24.19.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64"
},
"product_reference": "nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-devel-1:24.19.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le"
},
"product_reference": "nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-devel-1:24.19.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x"
},
"product_reference": "nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-devel-1:24.19.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64"
},
"product_reference": "nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-docs-1:24.19.0-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch"
},
"product_reference": "nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64"
},
"product_reference": "nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le"
},
"product_reference": "nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x"
},
"product_reference": "nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64"
},
"product_reference": "nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-libs-1:24.19.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64"
},
"product_reference": "nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-libs-1:24.19.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le"
},
"product_reference": "nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-libs-1:24.19.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x"
},
"product_reference": "nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-libs-1:24.19.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64"
},
"product_reference": "nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64"
},
"product_reference": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le"
},
"product_reference": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x"
},
"product_reference": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64"
},
"product_reference": "nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
},
"product_reference": "nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-56846",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-08-04T01:01:14.342521+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510856"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Node.js\u0027s handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Node.js HTTP/2 handling allows a remote attacker to bypass `maxSessionMemory` limits by sending specially crafted header blocks. This can lead to memory exhaustion and a denial of service for Node.js applications configured to use HTTP/2, without requiring authentication or user interaction.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56846"
},
{
"category": "external",
"summary": "RHBZ#2510856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510856"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56846",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56846"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56846",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56846"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
}
],
"release_date": "2026-08-04T00:49:58.319000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-31T12:20:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:61377"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to Node.js applications utilizing HTTP/2 to trusted clients only, by implementing firewall rules or network access controls. If HTTP/2 functionality is not essential for the application, consider disabling it in the Node.js configuration to prevent exploitation. Always ensure that any service restarts or reloads are performed carefully to avoid service disruption.",
"product_ids": [
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks"
},
{
"cve": "CVE-2026-56848",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-08-04T17:00:59.804520+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511089"
}
],
"notes": [
{
"category": "description",
"text": "A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still executing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A remote attacker can exploit an Important heap use-after-free vulnerability in Node.js HTTP/2 to crash applications. The flaw, caused by re-entrant memory operations, leads to a denial of service for Red Hat environments with HTTP/2 enabled.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56848"
},
{
"category": "external",
"summary": "RHBZ#2511089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511089"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56848",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56848"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56848",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56848"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
}
],
"release_date": "2026-08-04T15:57:24.399000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-31T12:20:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:61377"
},
{
"category": "workaround",
"details": "Restrict network access to Node.js HTTP/2 listeners to trusted clients only. If HTTP/2 is not required, disable it to remove the vulnerable handler from the attack surface.",
"product_ids": [
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service"
},
{
"cve": "CVE-2026-58043",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-07-30T07:02:23.280145+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509171"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Node.js allows an attacker, when the Permission Model is enabled, to bypass intended filesystem access restrictions. An attacker with initial access to a permitted path could read from or write to unauthorized locations, leading to a privilege escalation within the application\u0027s sandboxing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58043"
},
{
"category": "external",
"summary": "RHBZ#2509171",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509171"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58043"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58043",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58043"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases"
}
],
"release_date": "2026-07-30T06:02:50.095000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-31T12:20:58+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:61377"
},
{
"category": "workaround",
"details": "Avoid enabling the Node.js Permission Model by not using the `--permission` flag when starting Node.js applications. This prevents the vulnerable enforcement mechanism from being active. Disabling the Permission Model may remove an intended security layer if your application relies on it for sandboxing.",
"product_ids": [
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.src",
"AppStream-10.2.Z:nodejs24-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-debugsource-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-devel-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-docs-1:24.19.0-1.el10_2.noarch",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-full-i18n-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.aarch64",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.ppc64le",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.s390x",
"AppStream-10.2.Z:nodejs24-libs-debuginfo-1:24.19.0-1.el10_2.x86_64",
"AppStream-10.2.Z:nodejs24-npm-1:11.17.0-1.24.19.0.1.el10_2.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…