Red Hat Security Advisory

RHSA-2026:2781

nodejs:24 security update

Released 2026-02-17 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.13.0-1.module+el9.7.0+23894+c8377628.aarch64::nodejs:24, nodejs-1:24.13.0-1.module+el9.7.0+23894+c8377628.ppc64le::nodejs:24, nodejs-1:24.13.0-1.module+el9.7.0+23894+c8377628.s390x::nodejs:24 +25

Fixes 6 records

TI-2025-37010 CVE-2025-59465 · GHSA-w2pg-hw7v-f7m9

Uncontrolled resource consumption in NodeJS node

MEDIUM 46

A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03962 Published 2026-01-20 Fixed CWE-400

TI-2025-34814 CVE-2025-55130 · GHSA-62wc-jj78-f4f6

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and…

MEDIUM 45

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01697 Published 2026-01-20 Fixed CWE-289

TI-2026-17429 CVE-2026-21637 · GHSA-ggxc-26fx-987r

Uncontrolled resource consumption in NodeJS node

MEDIUM 41

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01119 Published 2026-01-20 Fixed CWE-400

TI-2025-34815 CVE-2025-55131 · GHSA-9jwr-p39p-hwg2

Buffer overflow in NodeJS node

LOW 39

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option.

CVSS 3.0HIGH 7.1 Network Low privileges No interaction EPSS 0.03455 Published 2026-01-20 Fixed CWE-120

TI-2025-37011 CVE-2025-59466 · GHSA-52xj-vx8w-46qj

We have identified a bug in Node.js error handling where "Maximum call stack size…

LOW 34

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00683 Published 2026-01-20 Fixed CWE-248

TI-2025-34816 CVE-2025-55132 · GHSA-pm9v-wcw9-xgpv

Incorrect default permissions in NodeJS node

LOW 24

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0026 Published 2026-01-20 Fixed CWE-276