Linux · Security advisory · April 15, 2026

RHSA-2026:8339: Security update for 8 packages

RHSA-2026:8339, released April 15, 2026, fixes 4 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.2544
97th percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
nodejsRHEL 81:20.20.2-1.module+el8.10.0+24197+1602b452
nodejs-develRHEL 81:20.20.2-1.module+el8.10.0+24197+1602b452
nodejs-docsRHEL 81:20.20.2-1.module+el8.10.0+24197+1602b452
nodejs-full-i18nRHEL 81:20.20.2-1.module+el8.10.0+24197+1602b452
nodejs-nodemonRHEL 80:3.0.1-1.module+el8.10.0+23521+490ebfde
nodejs-packagingRHEL 80:2021.06-6.module+el8.10.0+24197+1602b452
nodejs-packaging-bundlerRHEL 80:2021.06-6.module+el8.10.0+24197+1602b452
npmRHEL 81:10.8.2-1.20.20.2.1.module+el8.10.0+24197+1602b452

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-21710 A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** 7.5 0.2544 None reported
High CVE-2026-27135 nghttp2 Denial of service: Assertion failure due to the missing state validation 7.5 0.0082 None reported
High CVE-2026-26996 nodejs-libs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.5 0.0058 None reported
High CVE-2026-27904 nodejs-libs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... 7.5 0.0053 None reported
Showing 1 to 4 of 4 1