SB20261110240 - Fedora 45 update for nodejs22

Description

This security bulletin contains information about 28 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-58045)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the synchronous node:zlib APIs when processing a spoofed TypedArray byteLength. A local user can supply a crafted TypedArray value to cause a denial of service.

Repeated exploitation of this condition can crash the process.

2) Uncontrolled Recursion (CVE-ID: CVE-2026-102278)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing applications using brace-expansion.

The vulnerability exists due to uncontrolled recursion in brace-expansion's expand_() function when expanding nested comma alternatives or single-part brace sets. A remote attacker can supply strings generated by '{a,'.repeat(4000) + 'z' + '}'.repeat(4000) or '{'.repeat(3200) + 'a,b' + '}'.repeat(3200) to expand(), directly or through user-supplied minimatch/glob patterns, to exhaust the stack and terminate the process if the resulting exception is uncaught.

3) Uncontrolled Recursion (CVE-ID: CVE-2026-102276)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing applications that process untrusted brace-expansion patterns.

The vulnerability exists due to uncontrolled recursion and unbounded push.apply argument lists in brace-expansion's parseCommaParts() when parsing untrusted patterns. A remote attacker can supply expand('{' + '{a},'.repeat(7000) + 'b}') or expand('{{x},' + 'a,'.repeat(125000) + 'b}') to exhaust the stack and terminate applications that do not catch the resulting RangeError.

4) Insufficient verification of data authenticity (CVE-ID: CVE-2026-85008)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause unsafe HTTP requests to be served from the cache instead of reaching the origin.

The vulnerability exists due to insufficient verification of response authenticity in the undici cache interceptor when processing cacheable responses to unsafe HTTP methods. A remote attacker can return a heuristically cacheable response with an explicit Cache-Control max-age directive to an unsafe HTTP request to cause unsafe HTTP requests to be served from the cache instead of reaching the origin.

The issue occurs with the default methods: ['GET'] configuration.

5) Input validation error (CVE-ID: CVE-2026-84947)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause response truncation.

The vulnerability exists due to improper input validation in the dump interceptor when processing oversized chunked responses without a Content-Length header. A remote attacker can send an oversized chunked response to cause response truncation.

Exploitation requires the application to use the dump interceptor with an untrusted or misbehaving upstream.

6) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-18540)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause downstream response splitting or desynchronization.

The vulnerability exists due to inconsistent interpretation of HTTP response framing in the retry interceptor when resuming a partial response from an attacker-controlled upstream. A remote attacker can cause resumed response bytes to be appended to a partially delivered response body while its original status and headers are retained to cause downstream response splitting or desynchronization.

Exploitation requires interceptors.retry() to be enabled and a downstream forwarder that does not recalculate Content-Length.

7) Uncaught Exception (CVE-ID: CVE-2026-85024)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in the WebSocket permessage-deflate decompression handler when processing a compressed WebSocket message that exceeds the decompressed-payload size limit and contains a malformed DEFLATE block. A remote attacker can send a specially crafted compressed WebSocket message to cause a denial of service.

The internal InflateRaw error listener is removed while the stream continues running, causing an unhandled Z_DATA_ERROR to terminate the Node.js process.

8) Uncaught Exception (CVE-ID: CVE-2026-85014)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in the WebSocketStream socket-close handler when handling an abrupt WebSocket connection closure while a writer lock is held. A remote attacker can abruptly close a WebSocket connection to cause a denial of service.

Exploitation requires an application to use the WebSocketStream API and write through a writer.

9) Uncaught Exception (CVE-ID: CVE-2026-19534)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in the undici WebSocket client opening handshake when processing a server response containing an unrequested Sec-WebSocket-Protocol header. A remote attacker can send a crafted WebSocket handshake response to cause a denial of service.

Exploitation requires an application to open a WebSocket connection to an attacker-controlled or compromised server, or to use a plaintext ws:// connection subject to a machine-in-the-middle.

10) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-84890)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the interceptors.decompress() interceptor when decompressing HTTP response bodies according to an untrusted Content-Encoding header. A remote attacker can return a compression bomb as a compressed HTTP response to cause a denial of service.

Exploitation requires an application to use the decompress interceptor to read responses from an untrusted or compromised upstream.

11) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-48931)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to poison the HTTP response queue.

The vulnerability exists due to a time-of-check time-of-use race condition in http.Agent when accepting a response before the client has sent the request. A remote attacker can send a response early to poison the HTTP response queue.

12) Improper access control (CVE-ID: CVE-2026-56847)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write trace logs outside allowed filesystem paths.

The vulnerability exists due to improper access control in Node.js Permission Model enforcement when trace_events.createTracing().enable() writes trace logs. A local user can invoke trace_events.createTracing().enable() to write trace logs outside allowed filesystem paths.

This issue affects configurations that use the Permission Model with --allow-fs-write restrictions.

13) Input validation error (CVE-ID: CVE-2026-58042)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input handling in dns.resolveAny() when processing DNS responses containing more than 256 A records. A remote attacker can send or induce such a DNS response to cause a denial of service.

Repeated triggering of this condition can abort the process.

14) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-58044)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform request smuggling.

The vulnerability exists due to inconsistent header processing in the Node.js HTTP client when rebuilding outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection. A remote attacker can send a crafted request with hidden framing headers to perform request smuggling.

The issue affects Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while reusing backend connections.

15) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-13149)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in expand() when processing attacker-influenced brace expansion patterns containing consecutive non-expanding {} groups. A remote attacker can send a specially crafted input string to cause a denial of service.

The issue can block the calling thread for minutes or indefinitely with a small all-ASCII input, and applications using Node's single-threaded event loop may fully stall a worker or process.

16) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-58041)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to re-execute writes with new parameters.

The vulnerability exists due to improper state management in node:sqlite SQLTagStore when a stale StatementSyncIterator continues executing a cached prepared statement after it has been reset and rebound with new parameters. A local user can reuse a stale iterator to re-execute writes with new parameters.

The issue involves StatementSyncIterator objects created through DatabaseSync#createTagStore().

17) Improper access control (CVE-ID: CVE-2026-58039)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write or overwrite files outside allowed filesystem paths.

The vulnerability exists due to improper access control in Node.js Permission Model enforcement when process.report writes files. A local user can invoke process.report to write or overwrite files outside allowed filesystem paths.

This issue affects configurations that use --allow-fs-write restrictions.

18) Improper access control (CVE-ID: CVE-2026-58043)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read from or write to paths outside the intended filesystem allowlist.

The vulnerability exists due to improper access control in Node.js Permission Model path matching when handling radix-tree prefix boundaries under --permission. A local user can abuse prefix boundary handling to read from or write to paths outside the intended filesystem allowlist.

The issue applies only when the Permission Model is enabled with --permission.

19) Use-after-free (CVE-ID: CVE-2026-56848)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or potentially execute arbitrary code.

The vulnerability exists due to use-after-free in Node.js HTTP/2 handling when nghttp2_session_mem_send() is called re-entrantly while nghttp2_session_mem_recv() is executing. A remote attacker can trigger re-entrant HTTP/2 processing to cause a denial of service or potentially execute arbitrary code.

20) Resource exhaustion (CVE-ID: CVE-2026-56846)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in Node.js HTTP/2 handling when processing retained header blocks. A remote attacker can send specially crafted HTTP/2 header blocks to cause a denial of service.

21) Improper Certificate Validation (CVE-ID: CVE-2026-58040)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass hostname verification.

The vulnerability exists due to improper certificate validation in the Node.js HTTPS Agent when reusing TLS sessions across identity policies. A remote attacker can trigger TLS session reuse to bypass hostname verification.

This issue was identified as an incomplete fix for CVE-2026-48934.

22) Resource exhaustion (CVE-ID: CVE-2026-69152)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the expand() function when processing attacker-controlled brace patterns. A remote attacker can send a specially crafted input to cause a denial of service.

The issue can terminate the Node process with an uncatchable out-of-memory error or block the event loop for an extended period.

23) Improper access control (CVE-ID: CVE-2026-48617)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass the intended security boundary.

The vulnerability exists due to improper access control in process.report.writeReport() path validation when enforcing the permission model. A local user can provide a crafted path to bypass the intended security boundary.

This can lead to confidentiality impact under affected configurations.

24) Infinite loop (CVE-ID: CVE-2026-59874)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to loop with an unreachable exit condition in tar.replace() when scanning an attacker-controlled existing archive. A remote attacker can supply a specially crafted tar archive with a negative base-256 encoded entry size to cause a denial of service.

Only applications that call the replace API on an existing attacker-controlled archive are affected; plain extraction-only workflows are not affected.

25) Uncaught Exception (CVE-ID: CVE-2026-59875)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in the PAX extended header parser when processing attacker-supplied tarballs containing NUL bytes in path or linkpath records. A remote attacker can supply a specially crafted tarball to cause a denial of service.

The exception is triggered after the crafted value reaches filesystem operations and can bypass the consumer's await/try-catch error handling boundary.

26) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59873)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the Unpack stream in src/extract.ts when extracting crafted compressed tar archives. A remote attacker can send a specially crafted archive to cause a denial of service.

The issue can exhaust disk space and CPU through decompression and parsing of highly compressible input.

27) Type conversion (CVE-ID: CVE-2026-59871)

CWE-ID: CWE-704 - Type conversion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to incorrect type conversion or cast in the PAX header parser when parsing a crafted tar archive with an all-digit path value. A remote attacker can supply a specially crafted tar archive to cause a denial of service.

The crash occurs as an uncaught TypeError during extraction and bypasses application-level error handling, including error and warning handlers.

28) Interpretation Conflict (CVE-ID: CVE-2026-53655)

CWE-ID: CWE-436 - Interpretation Conflict

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to hide archive members from security tooling or downstream processing.

The vulnerability exists due to interpretation conflict in Header.decode in node-tar's tar parser when parsing an attacker-supplied tar archive containing a PAX extended header before intermediary GNU long-name or long-link headers. A remote attacker can supply a specially crafted archive to hide archive members from security tooling or downstream processing.

The issue occurs because PAX overrides such as size are applied to intermediary metadata headers, which can desynchronize parsing and cause different tar implementations to report different archive contents.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2026-ac6450bb30