Loading story…
Red Hat released Important security updates for the nodejs:20 module across Red Hat Enterprise Linux 8 and 9 to address multiple denial-of-service flaws, including CVE-2026-26996 in the JavaScript package minimatch. The minimatch bug allows a Regular Expression Denial of Service (ReDoS) when applications pass user-controlled glob patterns to minimatch(): specially crafted patterns with many consecutive asterisks followed by a literal character not present in the target string can trigger exponential backtracking in V8 after minimatch compiles each wildcard into separate [^/]*? regex groups. Red Hat said the issue affects minimatch 10.2.0 and earlier and is fixed in 10.2.1.
The remediation was shipped through advisories RHSA-2026:7896, RHSA-2026:8339, and RHSA-2026:9711, covering RHEL 9, RHEL 8, and RHEL 9.4 Extended Update Support channels respectively. The updates rebase Node.js 20 to 20.20.2 and include npm 10.8.2, while also addressing CVE-2026-21710 in Node.js, CVE-2026-27135 in nghttp2, and CVE-2026-27904 in minimatch. Red Hat listed affected and updated builds for x86_64, aarch64, ppc64le, and s390x, including EUS, SAP Solutions, 4-year update, AUS, and Extended Life Cycle channels.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-22, Red Hat published RHSA-2026:9874, an Important security advisory for the nodejs:20 module in Red Hat Enterprise Linux 9.6 Extended Update Support and related RHEL 9.6 channels. The update released Node.js 20.20.2-2 packages and fixed CVE-2026-26996 in minimatch along with three other denial-of-service vulnerabilities in minimatch, nghttp2, and Node.js.
On 2026-04-22, Red Hat published RHSA-2026:9711, an Important security advisory for the nodejs:20 module in Red Hat Enterprise Linux 9.4 Extended Update Support and related channels. The update released Node.js 20.20.2-2 packages and fixed CVE-2026-26996 in minimatch along with three other denial-of-service vulnerabilities.
On 2026-04-15, Red Hat's Bugzilla entry 2441268 documented CVE-2026-26996 as a denial-of-service vulnerability in minimatch caused by exponential regex backtracking from crafted glob patterns. The record also noted that Red Hat advisories were addressing the issue across multiple products.
On 2026-04-15, Red Hat published RHSA-2026:8339, an Important security advisory for the nodejs:20 module in Red Hat Enterprise Linux 8. The update rebased Node.js to 20.20.2 and fixed CVE-2026-26996 in minimatch together with additional denial-of-service issues in minimatch, nghttp2, and Node.js.
On 2026-04-13, Red Hat published RHSA-2026:7896, an Important security advisory for the nodejs:20 module in Red Hat Enterprise Linux 9. The update rebased Node.js to 20.20.2 and included fixes for CVE-2026-26996 in minimatch along with three other denial-of-service vulnerabilities.
The minimatch package fixed a Regular Expression Denial of Service vulnerability affecting version 10.2.0 and earlier, caused by specially crafted glob patterns with many consecutive wildcards. The Bugzilla record states the issue was resolved in minimatch version 10.2.1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for **Node.js 24** across **RHEL 8, RHEL 9, and RHEL 10**, rebasing packages to **Node.js 24.14.1** and fixing multiple flaws in Node.js and bundled components including **undici**, **nghttp2**, **brace-expansion**, **minimatch**, and **V8**. The advisories cover a broad set of impacts, including **denial of service**, **information disclosure**, **HTTP header injection**, **HTTP request smuggling**, **permission bypass**, and weaknesses affecting local inter-process communication. Affected builds span major RHEL architectures including `x86_64`, `s390x`, `ppc64le`, and `aarch64`, along with extended support variants.
Aug 21, 2026
Red Hat released **Important** security updates for Node.js packages across **RHEL 8, 9, and 10**, covering `nodejs:22`, `nodejs:24`, and `nodejs22` builds affected by vulnerabilities in bundled or related components. The advisories address **`CVE-2026-69192`** in the `ip-address` JavaScript library, where inconsistent parsing of IPv4 octets with leading zeros can cause applications to treat internal addresses as external, enabling **server-side request forgery (SSRF)** and trust-boundary bypass. Red Hat published errata including **RHSA-2026:54371**, **RHSA-2026:54530**, **RHSA-2026:55601**, **RHSA-2026:55603**, and **RHSA-2026:55541** for affected RHEL product streams and architectures. The updates also fix **`CVE-2026-69152`**, a high-severity denial-of-service flaw in `brace-expansion` that can exhaust memory or block the Node.js event loop through unbounded intermediate arrays, bypassing an earlier mitigation for **`CVE-2026-14257`**. Several advisories additionally include fixes for SQLite FTS5 arbitrary code execution issues bundled with Node.js-related packages. Red Hat said the `ip-address` issue is fixed in version **`10.3.1`**, while affected `brace-expansion` releases are corrected in versions prior to **`1.1.18`**, **`2.1.4`**, **`3.0.6`**, and **`5.0.9`**, with updated Node.js, `npm`, and related development packages now available for supported RHEL platforms.
Sep 4, 2026
Red Hat released **Important** security updates for **Node.js 22** across **RHEL 8, RHEL 9, RHEL 9.6 EUS, and RHEL 10**, rebasing affected packages to **Node.js 22.22.2** and updating related RPMs for `x86_64`, `aarch64`, `ppc64le`, and `s390x`. The advisories cover multiple vulnerabilities in Node.js and bundled components including **brace-expansion**, **minimatch**, **undici**, and **nghttp2**, with impacts dominated by denial-of-service conditions and one **HTTP request smuggling** flaw tied to duplicate `Content-Length` headers in `undici`. The fixes span a set of CVEs including `CVE-2026-25547`, `CVE-2026-26996`, `CVE-2026-27904`, `CVE-2026-1525`, `CVE-2026-1526`, `CVE-2026-1528`, `CVE-2026-2229`, `CVE-2026-27135`, and `CVE-2026-21710`. Red Hat’s Bugzilla entry for `CVE-2026-25547` says the **brace-expansion** package could be abused through unbounded brace range expansion, causing exponential CPU and memory consumption and potentially crashing Node.js processes; the issue was patched upstream in version **5.0.1** and incorporated into Red Hat’s errata for supported RHEL releases and lifecycle channels.
Aug 21, 2026