Linux · Security advisory · March 12, 2026

RHSA-2026:7670: Security update for 10 packages

RHSA-2026:7670, released March 12, 2026, fixes 17 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
17
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.2544
97th percentile

Priority of the 17 CVEs

Patch now 0 Urgent 0 High 17 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsRHEL 81:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-develRHEL 81:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-docsRHEL 81:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-full-i18nRHEL 81:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-libsRHEL 81:24.14.1-2.module+el8.10.0+24190+49a46c75
nodejs-nodemonRHEL 80:3.0.3-1.module+el8.10.0+24190+49a46c75
nodejs-packagingRHEL 80:2021.06-6.module+el8.10.0+24190+49a46c75
nodejs-packaging-bundlerRHEL 80:2021.06-6.module+el8.10.0+24190+49a46c75
npmRHEL 81:11.11.0-1.24.14.1.2.module+el8.10.0+24190+49a46c75
v8-13.6-develRHEL 83:13.6.233.17-1.24.14.1.2.module+el8.10.0+24190+49a46c75

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-21710 A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** 7.5 0.2544 None reported
High CVE-2026-1526 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.5 0.0120 None reported
High CVE-2026-21637 HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers 7.5 0.0112 N/A
High CVE-2026-2229 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.5 0.0091 None reported
High CVE-2026-27135 nghttp2 Denial of service: Assertion failure due to the missing state validation 7.5 0.0082 None reported
High CVE-2026-2581 nodejs-devel: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.5 0.0059 None reported
High CVE-2026-26996 nodejs-libs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.5 0.0058 None reported
High CVE-2026-1525 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 9.8 0.0052 None reported
High CVE-2026-1528 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.5 0.0051 None reported
High CVE-2026-21714 Node.js 14 and 15 others: Missing Release of Memory after Effective Lifetime 7.5 0.0043 None reported
High CVE-2026-21713 Node.js 14 and 15 others: Observable Timing Discrepancy 7.5 0.0037 None reported
High CVE-2026-21712 A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process. 7.5 0.0033 None reported
High CVE-2026-1527 nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.5 0.0029 None reported
High CVE-2026-21717 A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. 7.5 0.0027 None reported
High CVE-2026-21711 Node.js 14 and 12 others: Improper Access Control 7.5 0.0017 None reported
High CVE-2026-21715 Node.js 14 and 15 others: Incorrect Permission Assignment for Critical Resource 7.5 0.0015 None reported
High CVE-2026-21716 Node.js 14 and 15 others: Missing Authorization 7.5 0.0014 None reported
Showing 1 to 17 of 17 1