Red Hat Product Errata RHSA-2026:64817 - Security Advisory Issued: 2026-09-08 Updated: 2026-09-08 RHSA-2026:64817 - Security Advisory Overview Updated Packages Synopsis Important: nodejs22 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for nodejs22 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257) nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVE-2026-69152) ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192) nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2506433 - CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function BZ - 2509171 - CVE-2026-58043 nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw BZ - 2510722 - CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation BZ - 2510801 - CVE-2026-69192 ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass BZ - 2510856 - CVE-2026-56846 nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks CVEs CVE-2026-14257 CVE-2026-56846 CVE-2026-56848 CVE-2026-58043 CVE-2026-69152 CVE-2026-69192 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM nodejs22-22.23.2-1.el10_0.src.rpm SHA-256: 9d2b5e5a2d07cad0ec2adeb002852dbbaec08e282442fcbf32d5493df9325b03 x86_64 nodejs-22.23.2-1.el10_0.x86_64.rpm SHA-256: 3854b4b5a10f689b6217e8d1262923eb27272f6f1523f09d7164b7434cea2dec nodejs-debuginfo-22.23.2-1.el10_0.x86_64.rpm SHA-256: 8b50d105c000cf22e2a28762c85fd05dd02d0717256efcee96e514a232b5baef nodejs-devel-22.23.2-1.el10_0.x86_64.rpm SHA-256: 734bccf90b7aa9d7691ceb724d5be2fb52e383c9b7e480f9550dbc4ba5f99c27 nodejs-docs-22.23.2-1.el10_0.noarch.rpm SHA-256: c9efc194d031b223296473370ba2a17a00b4b09f771076a1b9c8172ac87eb112 nodejs-full-i18n-22.23.2-1.el10_0.x86_64.rpm SHA-256: 836a2d2f79c611f0897736c69b9c3ea8cc8c53ed65c11cf1555255a8cafcc17b nodejs-libs-22.23.2-1.el10_0.x86_64.rpm SHA-256: 2f5fced1dfd301882aecda2d71c7526a40ee36d34662f7c1a05ef04fbc778ac9 nodejs-libs-debuginfo-22.23.2-1.el10_0.x86_64.rpm SHA-256: 1ce4000b40cfdb511f80fd023eaeac9f13e3c5320447042d3d26452759ab5146 nodejs-npm-10.9.8-1.22.23.2.1.el10_0.x86_64.rpm SHA-256: f7d9a7121d059779a273ec0e21c435db13b0a468f0280f6b76b0bddd62e0b8bc nodejs22-debuginfo-22.23.2-1.el10_0.x86_64.rpm SHA-256: 1e6012993f8226911584de017e251f56ac9ee40d603d673e9ba5d4f68078b065 nodejs22-debugsource-22.23.2-1.el10_0.x86_64.rpm SHA-256: 5f0baccdda48f8afabb7e3a3b1e227586122f5721647810f5e32b582fe4379c0 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 SRPM nodejs22-22.23.2-1.el10_0.src.rpm SHA-256: 9d2b5e5a2d07cad0ec2adeb002852dbbaec08e282442fcbf32d5493df9325b03 s390x nodejs-22.23.2-1.el10_0.s390x.rpm SHA-256: e5f0682a9742e8c905e0b2cbd028692acf78fe826e297cec3cab771229bfad38 nodejs-debuginfo-22.23.2-1.el10_0.s390x.rpm SHA-256: 2368c3af2d372be3a18aa20b5f0f5571fcc4e9dc5f9e8873dc8776268fdf73e8 nodejs-devel-22.23.2-1.el10_0.s390x.rpm SHA-256: 0a2bb843c8580603d80a59b5a3b730a4f5374317f48cf555b02f63419a737242 nodejs-docs-22.23.2-1.el10_0.noarch.rpm SHA-256: c9efc194d031b223296473370ba2a17a00b4b09f771076a1b9c8172ac87eb112 nodejs-full-i18n-22.23.2-1.el10_0.s390x.rpm SHA-256: c0c652c38f80acf3cc103805ff8bd56d1fb4f5265791a38694023f6fd7a76052 nodejs-libs-22.23.2-1.el10_0.s390x.rpm SHA-256: 686a2517571a3e87d89fb15b6feb1f4c9ca4524b877e6d576c2f3994d6046f3d nodejs-libs-debuginfo-22.23.2-1.el10_0.s390x.rpm SHA-256: 3aa8ddccf349ac0fb51646c7e15e6ce5ccb6cdc57badf5a688c43c57cadbe9b2 nodejs-npm-10.9.8-1.22.23.2.1.el10_0.s390x.rpm SHA-256: e113461298819b2a1845890a586a3f09c3dc719851f75b21375c22199112114e nodejs22-debuginfo-22.23.2-1.el10_0.s390x.rpm SHA-256: 91c76cccdb7f776e27196bc9e82b3d3d0038d100242fc50fc828041b2a6d38aa nodejs22-debugsource-22.23.2-1.el10_0.s390x.rpm SHA-256: bb4fd763311f9ebcf8ce3efacdd9a10a0427820a9bb528efb401c710968f90ad Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 SRPM nodejs22-22.23.2-1.el10_0.src.rpm SHA-256: 9d2b5e5a2d07cad0ec2adeb002852dbbaec08e282442fcbf32d5493df9325b03 ppc64le nodejs-22.23.2-1.el10_0.ppc64le.rpm SHA-256: 86de82665c55a5ad977aabfea73d559c19eec715059973fc77c21ef7c2b31811 nodejs-debuginfo-22.23.2-1.el10_0.ppc64le.rpm SHA-256: a77d870b18cc342d83d58442a0a1a970e6b8509afe2e0e59fb30a0d998c8b29e nodejs-devel-22.23.2-1.el10_0.ppc64le.rpm SHA-256: 86aad51c248acb2541445d7ce450991467a94d1a83d891e66d66fce261e4389b nodejs-docs-22.23.2-1.el10_0.noarch.rpm SHA-256: c9efc194d031b223296473370ba2a17a00b4b09f771076a1b9c8172ac87eb112 nodejs-full-i18n-22.23.2-1.el10_0.ppc64le.rpm SHA-256: 72bae396948e880786f0c73a99736fa1e7211d86d0d3db6ff719d7b34ce04668 nodejs-libs-22.23.2-1.el10_0.ppc64le.rpm SHA-256: c88163e6dd3efd862864129c07d8378ea1ba499fa8d328c9a40a055d7d9b8fe1 nodejs-libs-debuginfo-22.23.2-1.el10_0.ppc64le.rpm SHA-256: 227264f997398ee971cac7bc1551b1acf46d69cbfb7d117095d6763dd0f0cd90 nodejs-npm-10.9.8-1.22.23.2.1.el10_0.ppc64le.rpm SHA-256: d440d5faea3bd511a2b5e12f59816f4711cd6b95aa3add7c290d1d59d68f7ba4 nodejs22-debuginfo-22.23.2-1.el10_0.ppc64le.rpm SHA-256: 37c4f108c12a8d72829c1c35b350ba0e10a53a6a14ff8f6203aa3fd832ec871f nodejs22-debugsource-22.23.2-1.el10_0.ppc64le.rpm SHA-256: 4d44f4f35c5922341da755d92ef601013144908fb24186d5003e600e357436cd Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 SRPM nodejs22-22.23.2-1.el10_0.src.rpm SHA-256: 9d2b5e5a2d07cad0ec2adeb002852dbbaec08e282442fcbf32d5493df9325b03 aarch64 nodejs-22.23.2-1.el10_0.aarch64.rpm SHA-256: 0dcf9e28183f2d6b1f1c9db6c2d872b7fc39d4e62840984042bf0265a271f031 nodejs-debuginfo-22.23.2-1.el10_0.aarch64.rpm SHA-256: 10feeddedd329d5f541abcbe40240f3c568e561cbece432019dedaa77f74caeb nodejs-devel-22.23.2-1.el10_0.aarch64.rpm SHA-256: b9d9ac1d64dc3ad84506c1c6b485c08c1a727386adc44589235a1bd2e79fb607 nodejs-docs-22.23.2-1.el10_0.noarch.rpm SHA-256: c9efc194d031b223296473370ba2a17a00b4b09f771076a1b9c8172ac87eb112 nodejs-full-i18n-22.23.2-1.el10_0.aarch64.rpm SHA-256: 157bef4d3dd36901c120dce3aa5e1bf4b801611c43697a4e1909ed4e82171a97 nodejs-libs-22.23.2-1.el10_0.aarch64.rpm SHA-256: 2511c0c3fcd98d28656dc18e8b5feca09f62350a708cf39e0203055e9cb2bed4 nodejs-libs-debuginfo-22.23.2-1.el10_0.aarch64.rpm SHA-256: 894e0138377a7d583abc1e30450fdcf0d1469452b740b58fc03d0ae9395da1c7 nodejs-npm-10.9.8-1.22.23.2.1.el10_0.aarch64.rpm SHA-256: 486915f705be4d0e6118b327d8649676073bdf6371feb08fbe6fd5997c630428 nodejs22-debuginfo-22.23.2-1.el10_0.aarch64.rpm SHA-256: 8db9e873e949b61c13de08262f1488b45b8f486a090ad4bf2d813faaf818a461 nodejs22-debugsource-22.23.2-1.el10_0.aarch64.rpm SHA-256: 358dda399691d01b2591b1caadbd083e394dddb20cd0250e25faef87f214bc33 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 SRPM nodejs22-22.23.2-1.el10_0.src.rpm SHA-256: 9d2b5e5a2d07cad0ec2adeb002852dbbaec08e282442fcbf32d5493df9325b03 aarch64 nodejs-22.23.2-1.el10_0.aarch64.rpm SHA-256: 0dcf9e28183f2d6b1f1c9db6c2d872b7fc39d4e62840984042bf0265a271f031 nodejs-debuginfo-22.23.2-1.el10_0.aarch64.rpm SHA-256: 10feeddedd329d5f541abcbe40240f3c568e561cbece432019dedaa77f74caeb nodejs-devel-22.23.2-1.el10_0.aarch64.rpm SHA-256: b9d9ac1d64dc3ad84506c1c6b485c08c1a727386adc44589235a1bd2e79fb607 nodejs-docs-22.23.2-1.el10_0.noarch.rpm SHA-256: c9efc194d031b223296473370ba2a17a00b4b09f771076a1b9c8172ac87eb112 nodejs-full-i18n-22.23.2-1.el10_0.aarch64.rpm SHA-256: 157bef4d3dd36901c120dce3aa5e1bf4b801611c43697a4e1909ed4e82171a97 nodejs-libs-22.23.2-1.el10_0.aarch64.rpm SHA-256: 2511c0c3fcd98d28656dc18e8b5feca09f62350a708cf39e0203