Red Hat Security Advisory

RHSA-2026:47057

nodejs:24 security update

Released 2026-08-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.18.0-3.module+el9.8.0+24537+83ec84e1.aarch64::nodejs:24, nodejs-1:24.18.0-3.module+el9.8.0+24537+83ec84e1.ppc64le::nodejs:24, nodejs-1:24.18.0-3.module+el9.8.0+24537+83ec84e1.s390x::nodejs:24 +25

TI-2026-42687 CVE-2026-59873 · GHSA-23hp-3jrh-7fpw

HIGH 79

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00582 Published 2026-07-08 Partial fix · 7.5.19 CWE-770

TI-2026-42688 CVE-2026-59874 · GHSA-8x88-c5mf-7j5w

HIGH 77

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00434 Published 2026-07-08 Partial fix · 7.5.18 CWE-835

TI-2026-11166 CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp

MEDIUM 40

brace-expansion through 5.0.6 is vulnerable to denial of service.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00364 Published 2026-06-30 Partial fix · 5.0.7, 1.1.16 +1 CWE-400