Linux · Security advisory · July 7, 2026
RHSA-2026:35892: Security update for 10 packages
RHSA-2026:35892, released July 7, 2026, fixes 16 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
16
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0371
89th percentile
Priority of the 16 CVEs
Patch now 0
Urgent 1
High 14
Routine 1
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| nodejs | RHEL 9 | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| nodejs-devel | RHEL 9 | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| nodejs-docs | RHEL 9 | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| nodejs-full-i18n | RHEL 9 | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| nodejs-libs | RHEL 9 | 1:22.23.1-1.module+el9.8.0+24457+996af7aa |
| nodejs-nodemon | RHEL 9 | 0:3.0.1-1.module+el9.8.0+24156+bb41d456 |
| nodejs-packaging | RHEL 9 | 0:2021.06-6.module+el9.8.0+24156+bb41d456 |
| nodejs-packaging-bundler | RHEL 9 | 0:2021.06-6.module+el9.8.0+24156+bb41d456 |
| npm | RHEL 9 | 1:10.9.8-1.22.23.1.1.module+el9.8.0+24457+996af7aa |
| v8-12.4-devel | RHEL 9 | 3:12.4.254.21-1.22.23.1.1.module+el9.8.0+24457+996af7aa |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2026-48930 | Node.js and 2 others: Improper Access Control - Generic | 9.8 | 0.0032 | None reported | |
| High | CVE-2026-48933 | Node.js and 2 others: Integer Overflow | 8.1 | 0.0371 | None reported | |
| High | CVE-2026-48618 | Node.js and 2 others: Improper Handling of Unicode Encoding | 8.1 | 0.0314 | None reported | |
| High | CVE-2026-12151 | nodejs20: This update for nodejs20 fixes the following issues: - CVE-2025-22150: undici: predictable random values used when d... | 8.1 | 0.0079 | None reported | |
| High | CVE-2026-48619 | Node.js and 2 others: Uncontrolled Resource Consumption | 8.1 | 0.0064 | None reported | |
| High | CVE-2026-48937 | Node.js 22 and 2 others: Uncontrolled Resource Consumption | 7.5 | 0.0057 | None reported | |
| High | CVE-2026-42338 | rh-podman-desktop: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript | 8.1 | 0.0047 | None reported | |
| High | CVE-2026-48615 | Node.js and 2 others: Privacy Violation | 8.1 | 0.0040 | None reported | |
| High | CVE-2026-9678 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 8.1 | 0.0039 | None reported | |
| High | CVE-2026-48617 | Node.js 22 and 2 others: Improper Access Control - Generic | 8.2 | 0.0032 | None reported | |
| High | CVE-2026-48934 | Node.js and 2 others: Improper Certificate Validation | 8.1 | 0.0026 | None reported | |
| High | CVE-2026-11525 | undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching | 8.1 | 0.0024 | None reported | |
| High | CVE-2026-6733 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 8.1 | 0.0022 | None reported | |
| High | CVE-2026-48928 | Node.js and 2 others: Improper Access Control - Generic | 8.1 | 0.0022 | None reported | |
| High | CVE-2026-48935 | Node.js and 2 others: Incorrect Default Permissions | 8.1 | 0.0019 | None reported | |
| Routine | CVE-2026-48931 | Node.js and 2 others: Time-of-check Time-of-use (TOCTOU) Race Condition | 3.7 | 0.0032 | None reported |
Showing 1 to 16 of 16
1