Red Hat Security Advisory

RHSA-2026:58819

nodejs24 security update

Released 2026-08-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.18.0-5.el10_2, nodejs24-devel-1:24.18.0-5.el10_2, nodejs24-docs-1:24.18.0-5.el10_2 +3

TI-2026-48541 CVE-2026-69192 · GHSA-mwp4-54f8-5fhr

HIGH 75

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00465 Published 2026-08-03 Partial fix · 10.3.1 CWE-20

TI-2026-48532 CVE-2026-69152 · GHSA-rgw5-rvv9-x895

HIGH 72

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00647 Published 2026-08-03 Partial fix · 1.1.18, 2.1.4 +2 CWE-400

TI-2026-39172 CVE-2026-54272 · GHSA-22jq-vg5j-6vgg

HIGH 70

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00401 Published 2026-07-27 Partial fix · 10.2.1 CWE-20

TI-2026-12072 CVE-2026-14257 · GHSA-mh99-v99m-4gvg

MEDIUM 40

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00643 Published 2026-07-23 Partial fix · 5.0.8, 3.0.3 +2 CWE-400