Loading story…
Red Hat released Important security updates for Node.js packages across RHEL 8, 9, and 10 to fix three denial-of-service vulnerabilities in bundled components: CVE-2026-13149 in brace-expansion, CVE-2026-59873 in node-tar, and CVE-2026-59874 in node-tar/tar. The advisories cover multiple product streams, including nodejs:24 on RHEL 8 and 9, nodejs22 and nodejs24 on RHEL 10, and nodejs:22 for RHEL 9.6 Extended Update Support, with updated packages such as Node.js 22.23.1 and 24.18.0 distributed across standard, EUS, and ELC channels.
The flaws could let attackers trigger excessive resource consumption through crafted input during archive handling or pattern expansion. In brace-expansion, consecutive non-expanding {} groups can drive exponential-time processing and block the event loop; in node-tar, a crafted gzip bomb can exhaust CPU and disk during extraction or parsing, while a malformed tar header with a negative base-256 entry size can cause the scanner to repeatedly parse the same header without making progress. Red Hat tracked the issues in Bugzilla and published remediation through advisories including RHSA-2026:47060, RHSA-2026:47057, RHSA-2026:48033, RHSA-2026:48034, RHSA-2026:52399, and RHSA-2026:53298.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:53298 for nodejs22 on RHEL 10.0 Extended Update Support, addressing CVE-2026-13149 and the two node-tar denial-of-service issues. The advisory provided updated nodejs22 22.23.1-3.el10_0 packages for x86_64, s390x, ppc64le, and aarch64.
Red Hat published RHSA-2026:52399 for the nodejs:22 module in RHEL 9.6 Extended Update Support, including fixes for CVE-2026-13149, CVE-2026-59873, and CVE-2026-59874 among other vulnerabilities. The update shipped Node.js 22.23.1-2.module+el9.6.0+24604+449f851b packages across multiple architectures and service channels.
Red Hat published RHSA-2026:48034 for nodejs24 on RHEL 10, fixing the same three denial-of-service vulnerabilities in brace-expansion and node-tar. Updated nodejs24 24.18.0-3.el10_2 packages were released for multiple RHEL 10 variants and architectures.
Red Hat published RHSA-2026:48033 for nodejs22 on RHEL 10, remediating CVE-2026-13149 and the two node-tar denial-of-service flaws. The advisory provided updated Node.js 22.23.1-4.el10_2 packages for multiple RHEL 10 architectures and support channels.
Red Hat published RHSA-2026:47057 for the nodejs:24 module on RHEL 9, addressing the brace-expansion and node-tar denial-of-service vulnerabilities. The update shipped Node.js 24.18.0-3 module packages across standard RHEL 9 and related support channels.
Red Hat published RHSA-2026:47060 for the nodejs:24 module on RHEL 8, fixing CVE-2026-13149 in brace-expansion and CVE-2026-59873/CVE-2026-59874 in node-tar. Updated Node.js 24.18.0-2 module packages were released for multiple RHEL 8 architectures and Extended Life Cycle 8.10 offerings.
Red Hat's OSIDB/Bzimport reported CVE-2026-59874 in Bugzilla as a high-severity node-tar denial-of-service vulnerability. The flaw involves tar.replace repeatedly parsing a checksum-valid header with a negative base-256 encoded entry size, affecting versions prior to 7.5.18.
Red Hat's OSIDB/Bzimport created the Bugzilla record for CVE-2026-59873, tracking a node-tar denial-of-service issue caused by a crafted gzip bomb. The record notes the flaw affects node-tar versions prior to 7.5.19.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for Node.js packages across **RHEL 8, 9, and 10**, covering `nodejs:22`, `nodejs:24`, and `nodejs22` builds affected by vulnerabilities in bundled or related components. The advisories address **`CVE-2026-69192`** in the `ip-address` JavaScript library, where inconsistent parsing of IPv4 octets with leading zeros can cause applications to treat internal addresses as external, enabling **server-side request forgery (SSRF)** and trust-boundary bypass. Red Hat published errata including **RHSA-2026:54371**, **RHSA-2026:54530**, **RHSA-2026:55601**, **RHSA-2026:55603**, and **RHSA-2026:55541** for affected RHEL product streams and architectures. The updates also fix **`CVE-2026-69152`**, a high-severity denial-of-service flaw in `brace-expansion` that can exhaust memory or block the Node.js event loop through unbounded intermediate arrays, bypassing an earlier mitigation for **`CVE-2026-14257`**. Several advisories additionally include fixes for SQLite FTS5 arbitrary code execution issues bundled with Node.js-related packages. Red Hat said the `ip-address` issue is fixed in version **`10.3.1`**, while affected `brace-expansion` releases are corrected in versions prior to **`1.1.18`**, **`2.1.4`**, **`3.0.6`**, and **`5.0.9`**, with updated Node.js, `npm`, and related development packages now available for supported RHEL platforms.
Sep 4, 2026
Red Hat released **Important** security updates for **Node.js 22** across **RHEL 8, RHEL 9, RHEL 9.6 EUS, and RHEL 10**, rebasing affected packages to **Node.js 22.22.2** and updating related RPMs for `x86_64`, `aarch64`, `ppc64le`, and `s390x`. The advisories cover multiple vulnerabilities in Node.js and bundled components including **brace-expansion**, **minimatch**, **undici**, and **nghttp2**, with impacts dominated by denial-of-service conditions and one **HTTP request smuggling** flaw tied to duplicate `Content-Length` headers in `undici`. The fixes span a set of CVEs including `CVE-2026-25547`, `CVE-2026-26996`, `CVE-2026-27904`, `CVE-2026-1525`, `CVE-2026-1526`, `CVE-2026-1528`, `CVE-2026-2229`, `CVE-2026-27135`, and `CVE-2026-21710`. Red Hat’s Bugzilla entry for `CVE-2026-25547` says the **brace-expansion** package could be abused through unbounded brace range expansion, causing exponential CPU and memory consumption and potentially crashing Node.js processes; the issue was patched upstream in version **5.0.1** and incorporated into Red Hat’s errata for supported RHEL releases and lifecycle channels.
Aug 21, 2026
Red Hat released **Important** security updates for **Node.js 24** across **RHEL 8, RHEL 9, and RHEL 10**, rebasing packages to **Node.js 24.14.1** and fixing multiple flaws in Node.js and bundled components including **undici**, **nghttp2**, **brace-expansion**, **minimatch**, and **V8**. The advisories cover a broad set of impacts, including **denial of service**, **information disclosure**, **HTTP header injection**, **HTTP request smuggling**, **permission bypass**, and weaknesses affecting local inter-process communication. Affected builds span major RHEL architectures including `x86_64`, `s390x`, `ppc64le`, and `aarch64`, along with extended support variants.
Aug 21, 2026