Red Hat Security AdvisoryRHSA-2026:9874
nodejs:20 security update
Released 2026-04-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.aarch64::nodejs:20, nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.ppc64le::nodejs:20, nodejs-1:20.20.2-2.module+el9.6.0+24220+c44c288d.s390x::nodejs:20 +20
Fixes 4 records
Priority HIGH 66
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00525 · Published 2026-02-26 · Partial fix · 10.2.3, 9.0.7 +6 CWE-1333
Priority MEDIUM 60
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.25443 · Published 2026-03-30 · Fixed CWE-770
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00577 · Published 2026-02-20 · Partial fix · 10.2.1, 9.0.6 +6 CWE-1333
Priority MEDIUM 40
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00823 · Published 2026-03-18 · Fixed in 1.68.1 CWE-617
THREATIST.IORead the docs