SB20260831129 - Red Hat Enterprise Linux 9 update for the nodejs:22 module
Published: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-58043)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read from or write to paths outside the intended filesystem allowlist.
The vulnerability exists due to improper access control in Node.js Permission Model path matching when handling radix-tree prefix boundaries under --permission. A local user can abuse prefix boundary handling to read from or write to paths outside the intended filesystem allowlist.
The issue applies only when the Permission Model is enabled with --permission.
2) Resource exhaustion (CVE-ID: CVE-2026-56846)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in Node.js HTTP/2 handling when processing retained header blocks. A remote attacker can send specially crafted HTTP/2 header blocks to cause a denial of service.
3) Use-after-free (CVE-ID: CVE-2026-56848)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.
The vulnerability exists due to use-after-free in Node.js HTTP/2 handling when nghttp2_session_mem_send() is called re-entrantly while nghttp2_session_mem_recv() is executing. A remote attacker can trigger re-entrant HTTP/2 processing to cause a denial of service or potentially execute arbitrary code.
Remediation
Install update from vendor's website.