Loading story…
Red Hat released Important security updates for Node.js 22 across RHEL 8, RHEL 9, RHEL 9.6 EUS, and RHEL 10, rebasing affected packages to Node.js 22.22.2 and updating related RPMs for x86_64, aarch64, ppc64le, and s390x. The advisories cover multiple vulnerabilities in Node.js and bundled components including brace-expansion, minimatch, undici, and nghttp2, with impacts dominated by denial-of-service conditions and one HTTP request smuggling flaw tied to duplicate Content-Length headers in undici.
The fixes span a set of CVEs including CVE-2026-25547, CVE-2026-26996, CVE-2026-27904, CVE-2026-1525, CVE-2026-1526, CVE-2026-1528, CVE-2026-2229, CVE-2026-27135, and CVE-2026-21710. Red Hat’s Bugzilla entry for CVE-2026-25547 says the brace-expansion package could be abused through unbounded brace range expansion, causing exponential CPU and memory consumption and potentially crashing Node.js processes; the issue was patched upstream in version 5.0.1 and incorporated into Red Hat’s errata for supported RHEL releases and lifecycle channels.
See real exploitation activity before you spend the cycle.
14 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-10, Red Hat published RHSA-2026:52399, an Important advisory for the nodejs:22 module in Red Hat Enterprise Linux 9.6 Extended Update Support and related channels. The update delivers Node.js 22.23.1 packages that fix eight vulnerabilities, including flaws in ip-address, undici, Node.js WebCrypto, Node.js itself, brace-expansion, and node-tar.
On 2026-07-28, Red Hat published RHSA-2026:47059, an Important advisory for the nodejs:22 module in Red Hat Enterprise Linux 8. The update delivers Node.js 22.23.1 packages that fix denial-of-service vulnerabilities in brace-expansion and tar/node-tar, including CVE-2026-13149, CVE-2026-59873, and CVE-2026-59874.
On 2026-07-20, Red Hat published RHSA-2026:41947, an Important advisory for the nodejs:22 module in Red Hat Enterprise Linux 8. The update rebases Node.js 22 to version 22.23.1 and fixes multiple vulnerabilities across Node.js, undici, and ip-address, including denial-of-service, information disclosure, authentication bypass, certificate validation bypass, trust-policy bypass, response queue poisoning, SameSite cookie parsing weakness, cross-site scripting, and unauthorized file metadata modification flaws.
On 2026-07-15, Red Hat published RHSA-2026:39868, an Important advisory for the nodejs:24 module in Red Hat Enterprise Linux 8. The update rebases Node.js to 24.18.0 and fixes multiple vulnerabilities across Node.js, undici, and ip-address, including denial-of-service, information disclosure, authentication bypass, certificate validation bypass, trust-policy bypass, response queue poisoning, man-in-the-middle risk, cross-site scripting, and unauthorized file metadata modification flaws.
On 2026-07-14, Red Hat published RHSA-2026:39246, an Important advisory for nodejs22 on Red Hat Enterprise Linux 10.0. The update provides Node.js 22.23.1-2.el10_0 packages that fix five vulnerabilities across ip-address, undici, Node.js WebCrypto, and Node.js, including cross-site scripting, denial-of-service, information disclosure, and authentication bypass flaws.
On 2026-07-06, Red Hat published RHSA-2026:35892, an Important advisory for the nodejs:22 module in Red Hat Enterprise Linux 9. The update rebases Node.js to 22.23.1 and fixes multiple vulnerabilities across Node.js, undici, and ip-address, including denial-of-service, information disclosure, authentication bypass, certificate validation bypass, trust-policy bypass, response queue poisoning, SameSite cookie parsing weakness, cross-site scripting, and unauthorized file metadata modification flaws.
On 2026-07-06, Red Hat published RHSA-2026:35842, an Important advisory for nodejs22 on Red Hat Enterprise Linux 10. The update rebases nodejs22 to Node.js 22.23.1-2.el10_2 and fixes multiple vulnerabilities in Node.js, undici, and ip-address, including denial-of-service, information disclosure, authentication bypass, certificate validation bypass, trust-policy bypass, and cross-site scripting flaws.
On 2026-04-14, Red Hat published RHSA-2026:7983, an Important advisory for the nodejs:22 module in Red Hat Enterprise Linux 9.6 Extended Update Support and related channels. The update delivers Node.js 22.22.2 packages to fix multiple denial-of-service vulnerabilities and an undici HTTP request smuggling issue.
On 2026-04-09, Red Hat published RHSA-2026:7310, an Important advisory for nodejs22 in Red Hat Enterprise Linux 10.0. The nodejs22-22.22.2-2.el10_0 update fixes the same set of Node.js ecosystem flaws, including several denial-of-service issues and an undici request-smuggling bug.
On 2026-04-09, Red Hat published RHSA-2026:7302, an Important advisory for the nodejs:22 module in Red Hat Enterprise Linux 9. The update provides Node.js 22.22.2 packages that remediate multiple vulnerabilities across brace-expansion, minimatch, undici, nghttp2, and Node.js itself.
On 2026-04-08, Red Hat published RHSA-2026:7123, an Important advisory for the nodejs:22 module in Red Hat Enterprise Linux 8. The update rebases nodejs:22 to Node.js 22.22.2 and fixes multiple denial-of-service flaws plus an undici HTTP request smuggling issue.
On 2026-04-08, Red Hat published RHSA-2026:7080, an Important advisory for nodejs22 on Red Hat Enterprise Linux 10. The update to Node.js 22.22.2-1.el10_1 fixes multiple vulnerabilities in Node.js, brace-expansion, minimatch, undici, and nghttp2, including an undici request-smuggling issue.
Red Hat Bugzilla recorded CVE-2026-25547, a brace-expansion denial-of-service flaw caused by unbounded brace range expansion. The bug entry says the issue was reported by OSIDB Bzimport on 2026-02-04 22:01 UTC.
The Bugzilla record states that CVE-2026-25547 was patched in @isaacs/brace-expansion version 5.0.1. No explicit release date for version 5.0.1 is provided in the content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
13 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for Node.js packages across **RHEL 8, 9, and 10**, covering `nodejs:22`, `nodejs:24`, and `nodejs22` builds affected by vulnerabilities in bundled or related components. The advisories address **`CVE-2026-69192`** in the `ip-address` JavaScript library, where inconsistent parsing of IPv4 octets with leading zeros can cause applications to treat internal addresses as external, enabling **server-side request forgery (SSRF)** and trust-boundary bypass. Red Hat published errata including **RHSA-2026:54371**, **RHSA-2026:54530**, **RHSA-2026:55601**, **RHSA-2026:55603**, and **RHSA-2026:55541** for affected RHEL product streams and architectures. The updates also fix **`CVE-2026-69152`**, a high-severity denial-of-service flaw in `brace-expansion` that can exhaust memory or block the Node.js event loop through unbounded intermediate arrays, bypassing an earlier mitigation for **`CVE-2026-14257`**. Several advisories additionally include fixes for SQLite FTS5 arbitrary code execution issues bundled with Node.js-related packages. Red Hat said the `ip-address` issue is fixed in version **`10.3.1`**, while affected `brace-expansion` releases are corrected in versions prior to **`1.1.18`**, **`2.1.4`**, **`3.0.6`**, and **`5.0.9`**, with updated Node.js, `npm`, and related development packages now available for supported RHEL platforms.
Sep 4, 2026
Red Hat released **Important** security updates for **Node.js 24** across **RHEL 8, RHEL 9, and RHEL 10**, rebasing packages to **Node.js 24.14.1** and fixing multiple flaws in Node.js and bundled components including **undici**, **nghttp2**, **brace-expansion**, **minimatch**, and **V8**. The advisories cover a broad set of impacts, including **denial of service**, **information disclosure**, **HTTP header injection**, **HTTP request smuggling**, **permission bypass**, and weaknesses affecting local inter-process communication. Affected builds span major RHEL architectures including `x86_64`, `s390x`, `ppc64le`, and `aarch64`, along with extended support variants.
Aug 21, 2026
Red Hat released **Important** security updates for Node.js packages across **RHEL 8, 9, and 10** to fix three denial-of-service vulnerabilities in bundled components: `CVE-2026-13149` in **brace-expansion**, `CVE-2026-59873` in **node-tar**, and `CVE-2026-59874` in **node-tar/tar**. The advisories cover multiple product streams, including `nodejs:24` on RHEL 8 and 9, `nodejs22` and `nodejs24` on RHEL 10, and `nodejs:22` for RHEL 9.6 Extended Update Support, with updated packages such as Node.js 22.23.1 and 24.18.0 distributed across standard, EUS, and ELC channels. The flaws could let attackers trigger excessive resource consumption through crafted input during archive handling or pattern expansion. In **brace-expansion**, consecutive non-expanding `{}` groups can drive exponential-time processing and block the event loop; in **node-tar**, a crafted gzip bomb can exhaust CPU and disk during extraction or parsing, while a malformed tar header with a negative base-256 entry size can cause the scanner to repeatedly parse the same header without making progress. Red Hat tracked the issues in Bugzilla and published remediation through advisories including `RHSA-2026:47060`, `RHSA-2026:47057`, `RHSA-2026:48033`, `RHSA-2026:48034`, `RHSA-2026:52399`, and `RHSA-2026:53298`.
Aug 23, 2026