SB20260831119 - Red Hat Enterprise Linux 9 update for the nodejs:24 module
Published: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2026-42338)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in a victim\'s browser.
The vulnerability exists due to cross-site scripting in Address6.group(), Address6.link(), and AddressError.parseMessage handling when rendering untrusted Address6 input or related HTML output as HTML. A remote attacker can supply crafted input or option values to inject script and execute arbitrary script in a victim\'s browser.
User interaction is required because a victim application must render the returned HTML or parseMessage as HTML.
2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-12151)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the WebSocket client message fragmentation handling when processing fragmented WebSocket messages from a server. A remote attacker can send many small or empty continuation frames to cause a denial of service.
Exploitation requires the application to connect to an attacker-controlled or compromised WebSocket endpoint using the WebSocket client or the WebSocketStream API.
3) Use of cache containing sensitive information (CVE-ID: CVE-2026-9678)
CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to use of cache containing sensitive information in the cache interceptor when processing responses with whitespace-padded qualified private or no-cache directives in the Cache-Control header. A remote attacker can send requests that resolve to the same cache key to disclose sensitive information.
Only applications that explicitly enable interceptors.cache() in shared-cache mode, forward Authorization headers upstream, and receive cacheable responses with non-canonical qualified directives are vulnerable.
4) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-6733)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause responses to be delivered to the wrong requests.
The vulnerability exists due to a time-of-check time-of-use race condition in the HTTP/1.1 client when reusing keep-alive sockets. A remote attacker can inject an unsolicited HTTP/1.1 response onto an idle socket to cause responses to be delivered to the wrong requests.
Exploitation requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.
5) Permissive List of Allowed Inputs (CVE-ID: CVE-2026-11525)
CWE-ID: CWE-183 - Permissive List of Allowed Inputs
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to weaken SameSite cookie policy enforcement.
The vulnerability exists due to permissive list of allowed inputs in the Set-Cookie header parser when parsing Set-Cookie headers from server responses. A remote attacker can send a specially crafted Set-Cookie header to weaken SameSite cookie policy enforcement.
The issue affects applications that forward or rely on the parsed sameSite attribute from server responses.
6) Improper Certificate Validation (CVE-ID: CVE-2026-9697)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to intercept and modify HTTPS traffic.
The vulnerability exists due to improper certificate validation in ProxyAgent and Socks5ProxyAgent when establishing HTTPS connections through a SOCKS5 proxy. A remote attacker can present a certificate signed by a publicly trusted CA for the target hostname to intercept and modify HTTPS traffic.
Only applications that rely on requestTls settings for TLS scope restriction when using a SOCKS5 proxy are affected.
7) Origin validation error (CVE-ID: CVE-2026-6734)
CWE-ID: CWE-346 - Origin Validation Error
CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information, modify request routing, and cause requests to be sent to the wrong origin.
The vulnerability exists due to origin validation error in Socks5ProxyAgent connection pool reuse when handling requests to multiple origins through a shared proxy agent. A remote user can trigger requests to a different origin through the reused pool to disclose sensitive information, modify request routing, and cause requests to be sent to the wrong origin.
Responses from the wrong origin may be trusted, and HTTPS requests may be silently downgraded to HTTP.
8) Resource exhaustion (CVE-ID: CVE-2026-48619)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in node:http2 clients when processing attacker-controlled ORIGIN frames. A remote attacker can send an unlimited number of ORIGIN frames to cause a denial of service.
The issue can lead to an out-of-memory condition on the client.
9) Improper Null Termination (CVE-ID: CVE-2026-48930)
CWE-ID: CWE-170 - Improper Null Termination
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass hostname-based authority checks.
The vulnerability exists due to c-string truncation in resolver bindings in TLS hostname handling when processing hostnames containing an embedded nul character. A remote attacker can present a crafted hostname to bypass hostname-based authority checks.
10) Improper access control (CVE-ID: CVE-2026-48935)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to modify file metadata outside intended permission restrictions.
The vulnerability exists due to improper access control in FileHandle.utimes() in the promises API when enforcing read-only filesystem permissions. A local user can invoke FileHandle.utimes() on a read-only path to modify file metadata outside intended permission restrictions.
11) Integer overflow (CVE-ID: CVE-2026-48933)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in the WebCrypto subtle.encrypt() implementation when processing input whose size is a multiple of 2 gib. A remote attacker can supply crafted input to cause a denial of service.
12) Improper Certificate Validation (CVE-ID: CVE-2026-48934)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate validation.
The vulnerability exists due to improper certificate validation in TLS host verification when reusing a session with a different servername. A remote attacker can reuse a session with a different servername to bypass certificate validation.
13) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-48928)
CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass mTLS authorization.
The vulnerability exists due to case-sensitive hostname matching in SNI context matching when selecting contexts in multi-context mTLS setups. A remote attacker can use an uppercase hostname to bypass mTLS authorization.
14) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-48615)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper handling of sensitive information in ERR_PROXY_TUNNEL error messages when processing proxy URLs with embedded credentials. A remote user can trigger an error handling path to disclose sensitive information.
The exposed data may be captured by logs, diagnostics, or other error consumers.
15) Input validation error (CVE-ID: CVE-2026-48618)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass tls wildcard-depth authentication.
The vulnerability exists due to improper input validation in TLS hostname handling when normalizing hostnames with unicode dot separators. A remote attacker can present a crafted hostname to bypass tls wildcard-depth authentication.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
Remediation
Install update from vendor's website.