Red Hat Security AdvisoryRHSA-2026:7123
nodejs:22 security update
Released 2026-04-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22 +28
Fixes 9 records
Priority HIGH 81
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0056 · Published 2026-03-12 · Partial fix · 6.24.0: 7.24.0, 6.24.0 +1 CWE-444
Priority HIGH 66
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00525 · Published 2026-02-26 · Partial fix · 10.2.3, 9.0.7 +6 CWE-1333
Priority MEDIUM 60
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.25443 · Published 2026-03-30 · Fixed CWE-770
Priority MEDIUM 46
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00538 · Published 2026-02-04 · Partial fix · 5.0.1 CWE-1333
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00577 · Published 2026-02-20 · Partial fix · 10.2.1, 9.0.6 +6 CWE-1333
Priority MEDIUM 41
ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01003 · Published 2026-03-12 · Partial fix · 6.24.0: 7.24.0, 6.24.0 +1 CWE-1284
Priority MEDIUM 41
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01279 · Published 2026-03-12 · Partial fix · 6.24.0: 7.24.0, 6.24.0 +1 CWE-409
Priority MEDIUM 40
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00823 · Published 2026-03-18 · Fixed in 1.68.1 CWE-617
Priority MEDIUM 40
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0056 · Published 2026-03-12 · Partial fix · 6.24.0: 7.24.0, 6.24.0 +1 CWE-1284
THREATIST.IORead the docs