Skip to content
Heist/ feed
UnratedFix available

Important: nodejs:22 security update

Type: advisorySource: OSV1 source record

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043) * nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) * nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Announced Source revision 1
Original source ↗

ALSA-2026:62219

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:ALSA-2026:62219

nodejs

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1:22.23.2-1.module_el8.10.0+4265+75d28086

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

nodejs-devel

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
1:22.23.2-1.module_el8.10.0+4265+75d28086

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

nodejs-docs

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
1:22.23.2-1.module_el8.10.0+4265+75d28086

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

nodejs-full-i18n

Source reference: /affected/3/package/name

Affected versions
Not stated in this record
Fixed versions
1:22.23.2-1.module_el8.10.0+4265+75d28086

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

nodejs-libs

Source reference: /affected/4/package/name

Affected versions
Not stated in this record
Fixed versions
1:22.23.2-1.module_el8.10.0+4265+75d28086

Source reference: /affected/4/ranges

Prerequisites
Not stated in this record

nodejs-nodemon

Source reference: /affected/5/package/name

Affected versions
Not stated in this record
Fixed versions
3.1.14-2.module_el8.10.0+4252+aedd4c30

Source reference: /affected/5/ranges

Prerequisites
Not stated in this record

nodejs-packaging

Source reference: /affected/6/package/name

Affected versions
Not stated in this record
Fixed versions
2021.06-6.module_el8.10.0+4158+e796f37f

Source reference: /affected/6/ranges

Prerequisites
Not stated in this record

nodejs-packaging-bundler

Source reference: /affected/7/package/name

Affected versions
Not stated in this record
Fixed versions
2021.06-6.module_el8.10.0+4158+e796f37f

Source reference: /affected/7/ranges

Prerequisites
Not stated in this record

npm

Source reference: /affected/8/package/name

Affected versions
Not stated in this record
Fixed versions
1:10.9.8-1.22.23.2.1.module_el8.10.0+4265+75d28086

Source reference: /affected/8/ranges

Prerequisites
Not stated in this record

v8-12.4-devel

Source reference: /affected/9/package/name

Affected versions
Not stated in this record
Fixed versions
3:12.4.254.21-1.22.23.2.1.module_el8.10.0+4265+75d28086

Source reference: /affected/9/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:22.23.2-1.module_el8.10.0+4265+75d28086"
          }
        ]
      }
    ],
    "package": {
      "name": "nodejs",
      "purl": "pkg:rpm/almalinux/nodejs",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:62219.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:22.23.2-1.module_el8.10.0+4265+75d28086"
          }
        ]
      }
    ],
    "package": {
      "name": "nodejs-devel",
      "purl": "pkg:rpm/almalinux/nodejs-devel",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:62219.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:22.23.2-1.module_el8.10.0+4265+75d28086"
          }
        ]
      }
    ],
    "package": {
      "name": "nodejs-docs",
      "purl": "pkg:rpm/almalinux/nodejs-docs",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:62219.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:22.23.2-1.module_el8.10.0+4265+75d28086"
          }
        ]
      }
    ],
    "package": {
      "name": "nodejs-full-i18n",
      "purl": "pkg:rpm/almalinux/nodejs-full-i18n",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:62219.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:22.23.2-1.module_el8.10.0+4265+75d28086"
          }
        ]
      }
    ],
    "package": {
      "name": "nodejs-libs",
      "purl": "pkg:rpm/almalinux/nodejs-libs",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:62219.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3.1.14-2.module_el8.10.0+4252+aedd4c30"
          }
        ]
      }
    ],
    "package": {
      "name": "nodejs-nodemon",
      "purl": "pkg:rpm/almalinux/nodejs-nodemon",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:62219.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2021.06-6.module_el8.10.0+4158+e796f37f"
          }
        ]
      }
    ],
    "package": {
      "name": "nodejs-packaging",
      "purl": "pkg:rpm/almalinux/nodejs-packaging",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:62219.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2021.06-6.module_el8.10.0+4158+e796f37f"
          }
        ]
      }
    ],
    "package": {
      "name": "nodejs-packaging-bundler",
      "purl": "pkg:rpm/almalinux/nodejs-packaging-bundler",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:62219.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1:10.9.8-1.22.23.2.1.module_el8.10.0+4265+75d28086"
          }
        ]
      }
    ],
    "package": {
      "name": "npm",
      "purl": "pkg:rpm/almalinux/npm",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:62219.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "3:12.4.254.21-1.22.23.2.1.module_el8.10.0+4265+75d28086"
          }
        ]
      }
    ],
    "package": {
      "name": "v8-12.4-devel",
      "purl": "pkg:rpm/almalinux/v8-12.4-devel",
      "ecosystem": "AlmaLinux:8"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:62219.json"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#37244 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement