HighFix available
Important: nodejs:22 security update
Type: advisorySources: OSV
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Products
- nodejs, nodejs-nodemon, nodejs-packaging
- Affected versions
- Not specified
- Fixed versions
- 0:2021.06-6.module+el9.7.0+40052+e32ea525, 0:2021.06-6.module+el9.7.0+40153+4d595597, 0:2021.06-6.module+el9.7.0+40165+d075e3f2, 0:2021.06-6.module+el9.8.0+40164+8921ab53, 0:3.1.14-2.module+el9.8.0+40264+d9b257bb, 0:3.1.14-2.module+el9.8.0+40280+057606e8, 1:22.23.2-2.module+el9.8.0+40374+17512296
- CVEs
- CVE-2026-19534, CVE-2026-9496
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:05 UTC · Revision 1
Source evidence
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
osv:RLSA-2026:76750
nodejs
Fixed versions: 1:22.23.2-2.module+el9.8.0+40374+17512296
nodejs-nodemon
Fixed versions: 0:3.1.14-2.module+el9.8.0+40280+057606e8
nodejs-nodemon
Fixed versions: 0:3.1.14-2.module+el9.8.0+40264+d9b257bb
nodejs-packaging
Fixed versions: 0:2021.06-6.module+el9.7.0+40052+e32ea525
nodejs-packaging
Fixed versions: 0:2021.06-6.module+el9.7.0+40153+4d595597
nodejs-packaging
Fixed versions: 0:2021.06-6.module+el9.7.0+40165+d075e3f2
nodejs-packaging
Fixed versions: 0:2021.06-6.module+el9.8.0+40164+8921ab53
Complete source record
{
"id": "381045b4402065f3323294c6dce1a981bf58a458abd740638a8808b76d77035e",
"url": "https://osv.dev/vulnerability/RLSA-2026%3A76750",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Important: nodejs:22 security update",
"summary": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"evidence": "osv:RLSA-2026:76750",
"products": [
{
"name": {
"value": "nodejs",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:22.23.2-2.module+el9.8.0+40374+17512296",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-nodemon",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:3.1.14-2.module+el9.8.0+40280+057606e8",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-nodemon",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:3.1.14-2.module+el9.8.0+40264+d9b257bb",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-packaging",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:2021.06-6.module+el9.7.0+40052+e32ea525",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-packaging",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:2021.06-6.module+el9.7.0+40153+4d595597",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-packaging",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:2021.06-6.module+el9.7.0+40165+d075e3f2",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-packaging",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0:2021.06-6.module+el9.8.0+40164+8921ab53",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "RLSA-2026:76750",
"aliases": [
"RLSA-2026:76750"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:22.23.2-2.module+el9.8.0+40374+17512296"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "nodejs",
"purl": "pkg:rpm/rocky-linux/nodejs?distro=rocky-linux-9&epoch=1",
"ecosystem": "Rocky Linux:9"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:76750.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:3.1.14-2.module+el9.8.0+40280+057606e8"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "nodejs-nodemon",
"purl": "pkg:rpm/rocky-linux/nodejs-nodemon?distro=rocky-linux-9&epoch=0",
"ecosystem": "Rocky Linux:9"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:76750.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:3.1.14-2.module+el9.8.0+40264+d9b257bb"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "nodejs-nodemon",
"purl": "pkg:rpm/rocky-linux/nodejs-nodemon?distro=rocky-linux-9&epoch=0",
"ecosystem": "Rocky Linux:9"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:76750.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:2021.06-6.module+el9.7.0+40052+e32ea525"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "nodejs-packaging",
"purl": "pkg:rpm/rocky-linux/nodejs-packaging?distro=rocky-linux-9&epoch=0",
"ecosystem": "Rocky Linux:9"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:76750.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:2021.06-6.module+el9.7.0+40153+4d595597"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "nodejs-packaging",
"purl": "pkg:rpm/rocky-linux/nodejs-packaging?distro=rocky-linux-9&epoch=0",
"ecosystem": "Rocky Linux:9"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:76750.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:2021.06-6.module+el9.7.0+40165+d075e3f2"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "nodejs-packaging",
"purl": "pkg:rpm/rocky-linux/nodejs-packaging?distro=rocky-linux-9&epoch=0",
"ecosystem": "Rocky Linux:9"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:76750.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0:2021.06-6.module+el9.8.0+40164+8921ab53"
}
],
"database_specific": {
"yum_repository": "AppStream"
}
}
],
"package": {
"name": "nodejs-packaging",
"purl": "pkg:rpm/rocky-linux/nodejs-packaging?distro=rocky-linux-9&epoch=0",
"ecosystem": "Rocky Linux:9"
},
"database_specific": {
"source": "https://storage.googleapis.com/resf-osv-data/RLSA-2026:76750.json"
}
}
],
"modified": "2026-10-08T12:30:02.535494174Z",
"provider": "osv",
"upstream": [
"CVE-2026-19534",
"CVE-2026-9496"
],
"references": [
"https://errata.rockylinux.org/RLSA-2026:76750",
"https://bugzilla.redhat.com/show_bug.cgi?id=2481394",
"https://bugzilla.redhat.com/show_bug.cgi?id=2528759",
"https://access.redhat.com/errata/RHSA-2026:76750"
],
"provider_metadata": {
"license": "CC-BY-4.0",
"license_url": "https://creativecommons.org/licenses/by/4.0/",
"source_advisory": "RHSA-2026:76750"
}
},
"related_cves": [
{
"value": "CVE-2026-19534",
"evidence": "/upstream"
},
{
"value": "CVE-2026-9496",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 99144,
"published_at": "2026-10-08T12:05:18.828+00:00"
}