Loading story…
Red Hat released Important security updates for Node.js 24 across RHEL 8, RHEL 9, and RHEL 10, rebasing packages to Node.js 24.14.1 and fixing multiple flaws in Node.js and bundled components including undici, nghttp2, brace-expansion, minimatch, and V8. The advisories cover a broad set of impacts, including denial of service, information disclosure, HTTP header injection, HTTP request smuggling, permission bypass, and weaknesses affecting local inter-process communication. Affected builds span major RHEL architectures including x86_64, s390x, ppc64le, and aarch64, along with extended support variants.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat disclosed that brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion in expand(), fixed in version 5.0.8 with a new maxLength option. The Bugzilla reference states Red Hat addressed the issue in Red Hat Enterprise Linux 8, 9, and 10 and published multiple advisories for affected products.
Red Hat disclosed CVE-2026-9678 in Undici, where improper parsing of whitespace-padded Cache-Control qualified field names can cause authenticated responses to be cached and later served to other callers in shared-cache mode. The Bugzilla entry states Red Hat addressed the issue through advisories for Red Hat Enterprise Linux 8, 9, and 10.
On 2026-04-13, Red Hat published RHSA-2026:7675, an Important security advisory for nodejs24 on Red Hat Enterprise Linux 10. The update delivered nodejs24 version 24.14.1-2.el10_1 and fixed multiple vulnerabilities in Node.js and bundled components including undici, nghttp2, brace-expansion, minimatch, and V8.
On 2026-04-13, Red Hat published RHSA-2026:7670, an Important security advisory for the nodejs:24 module on Red Hat Enterprise Linux 8. The update rebased Node.js to 24.14.1 and addressed multiple denial-of-service, request smuggling, information disclosure, permission bypass, and IPC-related flaws.
On 2026-04-09, Red Hat published RHSA-2026:7350, an Important security advisory for the nodejs:24 module on Red Hat Enterprise Linux 9. The update rebased Node.js to 24.14.1 and fixed multiple vulnerabilities across Node.js and bundled components including undici, brace-expansion, minimatch, nghttp2, and V8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for Node.js packages across **RHEL 8, 9, and 10**, covering `nodejs:22`, `nodejs:24`, and `nodejs22` builds affected by vulnerabilities in bundled or related components. The advisories address **`CVE-2026-69192`** in the `ip-address` JavaScript library, where inconsistent parsing of IPv4 octets with leading zeros can cause applications to treat internal addresses as external, enabling **server-side request forgery (SSRF)** and trust-boundary bypass. Red Hat published errata including **RHSA-2026:54371**, **RHSA-2026:54530**, **RHSA-2026:55601**, **RHSA-2026:55603**, and **RHSA-2026:55541** for affected RHEL product streams and architectures. The updates also fix **`CVE-2026-69152`**, a high-severity denial-of-service flaw in `brace-expansion` that can exhaust memory or block the Node.js event loop through unbounded intermediate arrays, bypassing an earlier mitigation for **`CVE-2026-14257`**. Several advisories additionally include fixes for SQLite FTS5 arbitrary code execution issues bundled with Node.js-related packages. Red Hat said the `ip-address` issue is fixed in version **`10.3.1`**, while affected `brace-expansion` releases are corrected in versions prior to **`1.1.18`**, **`2.1.4`**, **`3.0.6`**, and **`5.0.9`**, with updated Node.js, `npm`, and related development packages now available for supported RHEL platforms.
Sep 4, 2026
Red Hat released **Important** security updates for the `nodejs:20` module across Red Hat Enterprise Linux 8 and 9 to address multiple denial-of-service flaws, including **`CVE-2026-26996`** in the JavaScript package **minimatch**. The minimatch bug allows a **Regular Expression Denial of Service (ReDoS)** when applications pass user-controlled glob patterns to `minimatch()`: specially crafted patterns with many consecutive asterisks followed by a literal character not present in the target string can trigger exponential backtracking in V8 after minimatch compiles each wildcard into separate `[^/]*?` regex groups. Red Hat said the issue affects minimatch **10.2.0 and earlier** and is fixed in **10.2.1**. The remediation was shipped through advisories **`RHSA-2026:7896`**, **`RHSA-2026:8339`**, and **`RHSA-2026:9711`**, covering RHEL 9, RHEL 8, and RHEL 9.4 Extended Update Support channels respectively. The updates rebase Node.js 20 to **20.20.2** and include **npm 10.8.2**, while also addressing **`CVE-2026-21710`** in Node.js, **`CVE-2026-27135`** in nghttp2, and **`CVE-2026-27904`** in minimatch. Red Hat listed affected and updated builds for `x86_64`, `aarch64`, `ppc64le`, and `s390x`, including EUS, SAP Solutions, 4-year update, AUS, and Extended Life Cycle channels.
Aug 21, 2026
Red Hat released **Important** security updates for **Node.js 22** across **RHEL 8, RHEL 9, RHEL 9.6 EUS, and RHEL 10**, rebasing affected packages to **Node.js 22.22.2** and updating related RPMs for `x86_64`, `aarch64`, `ppc64le`, and `s390x`. The advisories cover multiple vulnerabilities in Node.js and bundled components including **brace-expansion**, **minimatch**, **undici**, and **nghttp2**, with impacts dominated by denial-of-service conditions and one **HTTP request smuggling** flaw tied to duplicate `Content-Length` headers in `undici`. The fixes span a set of CVEs including `CVE-2026-25547`, `CVE-2026-26996`, `CVE-2026-27904`, `CVE-2026-1525`, `CVE-2026-1526`, `CVE-2026-1528`, `CVE-2026-2229`, `CVE-2026-27135`, and `CVE-2026-21710`. Red Hat’s Bugzilla entry for `CVE-2026-25547` says the **brace-expansion** package could be abused through unbounded brace range expansion, causing exponential CPU and memory consumption and potentially crashing Node.js processes; the issue was patched upstream in version **5.0.1** and incorporated into Red Hat’s errata for supported RHEL releases and lifecycle channels.
Aug 21, 2026