# ALSA-2026:7675: Security update for 2 packages

ALSA-2026:7675, released April 13, 2026, fixes 18 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/alsa-2026-7675
- Platform: Linux
- Released: Apr 13, 2026
- Priority: High (Closes CVE-2026-21710, high severity)
- CVEs: 18, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:7675

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [nodejs24-docs](https://patchblox.com/security/data/product/linux/nodejs24-docs.md) | almalinux 10 | 1:24.14.1-2.el10_1 |
| [nodejs24-npm](https://patchblox.com/security/data/product/linux/nodejs24-npm.md) | almalinux 10 | 1:11.11.0-1.24.14.1.2.el10_1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-21710](https://patchblox.com/security/data/cve/CVE-2026-21710.md) | High | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.  When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.  * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** | 7.5 | 0.2544 |  |
| [CVE-2026-1526](https://patchblox.com/security/data/cve/CVE-2026-1526.md) | High | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0120 |  |
| [CVE-2026-21637](https://patchblox.com/security/data/cve/CVE-2026-21637.md) | High | HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers | 7.5 | 0.0112 |  |
| [CVE-2026-2229](https://patchblox.com/security/data/cve/CVE-2026-2229.md) | High | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0091 |  |
| [CVE-2026-27135](https://patchblox.com/security/data/cve/CVE-2026-27135.md) | High | nghttp2 Denial of service: Assertion failure due to the missing state validation | 7.5 | 0.0082 |  |
| [CVE-2026-2581](https://patchblox.com/security/data/cve/CVE-2026-2581.md) | High | nodejs-devel: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0059 |  |
| [CVE-2026-26996](https://patchblox.com/security/data/cve/CVE-2026-26996.md) | High | nodejs-libs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0058 |  |
| [CVE-2026-25547](https://patchblox.com/security/data/cve/CVE-2026-25547.md) | High | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0054 |  |
| [CVE-2026-1525](https://patchblox.com/security/data/cve/CVE-2026-1525.md) | High | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 9.8 | 0.0052 |  |
| [CVE-2026-1528](https://patchblox.com/security/data/cve/CVE-2026-1528.md) | High | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0051 |  |
| [CVE-2026-21714](https://patchblox.com/security/data/cve/CVE-2026-21714.md) | High | Node.js 14 and 15 others: Missing Release of Memory after Effective Lifetime | 7.5 | 0.0043 |  |
| [CVE-2026-21713](https://patchblox.com/security/data/cve/CVE-2026-21713.md) | High | Node.js 14 and 15 others: Observable Timing Discrepancy | 7.5 | 0.0037 |  |
| [CVE-2026-21712](https://patchblox.com/security/data/cve/CVE-2026-21712.md) | High | A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process. | 7.5 | 0.0033 |  |
| [CVE-2026-1527](https://patchblox.com/security/data/cve/CVE-2026-1527.md) | High | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0029 |  |
| [CVE-2026-21717](https://patchblox.com/security/data/cve/CVE-2026-21717.md) | High | A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.  The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.  This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. | 7.5 | 0.0027 |  |
| [CVE-2026-21711](https://patchblox.com/security/data/cve/CVE-2026-21711.md) | High | Node.js 14 and 12 others: Improper Access Control | 7.5 | 0.0017 |  |
| [CVE-2026-21715](https://patchblox.com/security/data/cve/CVE-2026-21715.md) | High | Node.js 14 and 15 others: Incorrect Permission Assignment for Critical Resource | 7.5 | 0.0015 |  |
| [CVE-2026-21716](https://patchblox.com/security/data/cve/CVE-2026-21716.md) | High | Node.js 14 and 15 others: Missing Authorization | 7.5 | 0.0014 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo