Linux · Security advisory · July 16, 2026
ELSA-2026-35841: Security update for 6 packages
ELSA-2026-35841, released July 16, 2026, fixes 15 CVEs across 6 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
15
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0371
89th percentile
Priority of the 15 CVEs
Patch now 0
Urgent 1
High 14
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| nodejs24 | ol 10 | 1:24.18.0-1.0.1.el10_2 |
| nodejs24-devel | ol 10 | 1:24.18.0-1.0.1.el10_2 |
| nodejs24-docs | ol 10 | 1:24.18.0-1.0.1.el10_2 |
| nodejs24-full-i18n | ol 10 | 1:24.18.0-1.0.1.el10_2 |
| nodejs24-libs | ol 10 | 1:24.18.0-1.0.1.el10_2 |
| nodejs24-npm | ol 10 | 1:11.16.0-1.24.18.0.1.0.1.el10_2 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2026-48930 | Node.js and 2 others: Improper Access Control - Generic | 9.8 | 0.0032 | None reported | |
| High | CVE-2026-48933 | Node.js and 2 others: Integer Overflow | 8.1 | 0.0371 | None reported | |
| High | CVE-2026-48618 | Node.js and 2 others: Improper Handling of Unicode Encoding | 8.1 | 0.0314 | None reported | |
| High | CVE-2026-12151 | nodejs20: This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when d... | 8.1 | 0.0079 | None reported | |
| High | CVE-2026-48619 | Node.js and 2 others: Uncontrolled Resource Consumption | 8.1 | 0.0064 | None reported | |
| High | CVE-2026-42338 | rh-podman-desktop: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript | 8.1 | 0.0047 | None reported | |
| High | CVE-2026-9697 | undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent | 8.1 | 0.0046 | None reported | |
| High | CVE-2026-48615 | Node.js and 2 others: Privacy Violation | 8.1 | 0.0040 | None reported | |
| High | CVE-2026-9678 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 8.1 | 0.0039 | None reported | |
| High | CVE-2026-6734 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 8.8 | 0.0035 | None reported | |
| High | CVE-2026-48934 | Node.js and 2 others: Improper Certificate Validation | 8.1 | 0.0026 | None reported | |
| High | CVE-2026-11525 | undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching | 8.1 | 0.0024 | None reported | |
| High | CVE-2026-6733 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 8.1 | 0.0022 | None reported | |
| High | CVE-2026-48928 | Node.js and 2 others: Improper Access Control - Generic | 8.1 | 0.0022 | None reported | |
| High | CVE-2026-48935 | Node.js and 2 others: Incorrect Default Permissions | 8.1 | 0.0019 | None reported |
Showing 1 to 15 of 15
1