UnratedFix available
Important: nodejs:22 security update
Type: advisorySources: OSV
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Products
- nodejs, nodejs-devel, nodejs-docs, nodejs-full-i18n, nodejs-libs, nodejs-nodemon, nodejs-packaging, nodejs-packaging-bundler, npm, v8-12.4-devel
- Affected versions
- Not specified
- Fixed versions
- 1:10.9.8-1.22.23.2.2.module_el8.10.0+4296+737cb4d7, 1:22.23.2-2.module_el8.10.0+4296+737cb4d7, 2021.06-6.module_el8.10.0+4158+e796f37f, 3.1.14-2.module_el8.10.0+4252+aedd4c30, 3:12.4.254.21-1.22.23.2.2.module_el8.10.0+4296+737cb4d7
- CVEs
- Not specified
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 04:07 UTC · Revision 1
Source evidence
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
osv:ALSA-2026:75870
nodejs
Fixed versions: 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-devel
Fixed versions: 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-docs
Fixed versions: 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-full-i18n
Fixed versions: 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-libs
Fixed versions: 1:22.23.2-2.module_el8.10.0+4296+737cb4d7
nodejs-nodemon
Fixed versions: 3.1.14-2.module_el8.10.0+4252+aedd4c30
nodejs-packaging
Fixed versions: 2021.06-6.module_el8.10.0+4158+e796f37f
nodejs-packaging-bundler
Fixed versions: 2021.06-6.module_el8.10.0+4158+e796f37f
npm
Fixed versions: 1:10.9.8-1.22.23.2.2.module_el8.10.0+4296+737cb4d7
v8-12.4-devel
Fixed versions: 3:12.4.254.21-1.22.23.2.2.module_el8.10.0+4296+737cb4d7
Complete source record
{
"id": "8ff9c14048748161d68270b36a19aee83a8484f9a6147fe41615fb8614695b73",
"url": "https://osv.dev/vulnerability/ALSA-2026%3A75870",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Important: nodejs:22 security update",
"summary": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"evidence": "osv:ALSA-2026:75870",
"products": [
{
"name": {
"value": "nodejs",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:22.23.2-2.module_el8.10.0+4296+737cb4d7",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-devel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:22.23.2-2.module_el8.10.0+4296+737cb4d7",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-docs",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:22.23.2-2.module_el8.10.0+4296+737cb4d7",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-full-i18n",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:22.23.2-2.module_el8.10.0+4296+737cb4d7",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-libs",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:22.23.2-2.module_el8.10.0+4296+737cb4d7",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-nodemon",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.1.14-2.module_el8.10.0+4252+aedd4c30",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-packaging",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2021.06-6.module_el8.10.0+4158+e796f37f",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "nodejs-packaging-bundler",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2021.06-6.module_el8.10.0+4158+e796f37f",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "npm",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:10.9.8-1.22.23.2.2.module_el8.10.0+4296+737cb4d7",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "v8-12.4-devel",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3:12.4.254.21-1.22.23.2.2.module_el8.10.0+4296+737cb4d7",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "ALSA-2026:75870",
"aliases": [
"ALSA-2026:75870"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:22.23.2-2.module_el8.10.0+4296+737cb4d7"
}
]
}
],
"package": {
"name": "nodejs",
"purl": "pkg:rpm/almalinux/nodejs",
"ecosystem": "AlmaLinux:8"
},
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:75870.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:22.23.2-2.module_el8.10.0+4296+737cb4d7"
}
]
}
],
"package": {
"name": "nodejs-devel",
"purl": "pkg:rpm/almalinux/nodejs-devel",
"ecosystem": "AlmaLinux:8"
},
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:75870.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:22.23.2-2.module_el8.10.0+4296+737cb4d7"
}
]
}
],
"package": {
"name": "nodejs-docs",
"purl": "pkg:rpm/almalinux/nodejs-docs",
"ecosystem": "AlmaLinux:8"
},
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:75870.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:22.23.2-2.module_el8.10.0+4296+737cb4d7"
}
]
}
],
"package": {
"name": "nodejs-full-i18n",
"purl": "pkg:rpm/almalinux/nodejs-full-i18n",
"ecosystem": "AlmaLinux:8"
},
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:75870.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:22.23.2-2.module_el8.10.0+4296+737cb4d7"
}
]
}
],
"package": {
"name": "nodejs-libs",
"purl": "pkg:rpm/almalinux/nodejs-libs",
"ecosystem": "AlmaLinux:8"
},
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:75870.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.14-2.module_el8.10.0+4252+aedd4c30"
}
]
}
],
"package": {
"name": "nodejs-nodemon",
"purl": "pkg:rpm/almalinux/nodejs-nodemon",
"ecosystem": "AlmaLinux:8"
},
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:75870.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2021.06-6.module_el8.10.0+4158+e796f37f"
}
]
}
],
"package": {
"name": "nodejs-packaging",
"purl": "pkg:rpm/almalinux/nodejs-packaging",
"ecosystem": "AlmaLinux:8"
},
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:75870.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2021.06-6.module_el8.10.0+4158+e796f37f"
}
]
}
],
"package": {
"name": "nodejs-packaging-bundler",
"purl": "pkg:rpm/almalinux/nodejs-packaging-bundler",
"ecosystem": "AlmaLinux:8"
},
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:75870.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:10.9.8-1.22.23.2.2.module_el8.10.0+4296+737cb4d7"
}
]
}
],
"package": {
"name": "npm",
"purl": "pkg:rpm/almalinux/npm",
"ecosystem": "AlmaLinux:8"
},
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:75870.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3:12.4.254.21-1.22.23.2.2.module_el8.10.0+4296+737cb4d7"
}
]
}
],
"package": {
"name": "v8-12.4-devel",
"purl": "pkg:rpm/almalinux/v8-12.4-devel",
"ecosystem": "AlmaLinux:8"
},
"database_specific": {
"source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:75870.json"
}
}
],
"modified": "2026-10-07T12:56:52.518953445Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2026:75870",
"https://access.redhat.com/security/cve/CVE-2026-19534",
"https://access.redhat.com/security/cve/CVE-2026-9496",
"https://bugzilla.redhat.com/2481394",
"https://bugzilla.redhat.com/2528759",
"https://errata.almalinux.org/8/ALSA-2026-75870.html"
]
},
"related_cves": [],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 95031,
"published_at": "2026-10-05T00:00:00+00:00"
}