Linux · 
Red Hat · Security advisory · September 30, 2026
Red Hat · Security advisory · September 30, 2026RHSA-2026:96226: Security update for 10 packages
RHSA-2026:96226, released September 30, 2026, fixes 10 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
10
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0049
42nd percentile
Priority of the 10 CVEs
Patch now 0
Urgent 1
High 9
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| nodejs | RHEL 9 | 1:24.22.1-5.module+el9.8.0+25292+33251f3b |
| nodejs-devel | RHEL 9 | 1:24.22.1-5.module+el9.8.0+25292+33251f3b |
| nodejs-docs | RHEL 9 | 1:24.22.1-5.module+el9.8.0+25292+33251f3b |
| nodejs-full-i18n | RHEL 9 | 1:24.22.1-5.module+el9.8.0+25292+33251f3b |
| nodejs-libs | RHEL 9 | 1:24.22.1-5.module+el9.8.0+25292+33251f3b |
| nodejs-nodemon | RHEL 9 | 0:3.1.14-6.module+el9.8.0+25292+33251f3b |
| nodejs-packaging | RHEL 9 | 0:2021.06-6.module+el9.8.0+24708+e71d2e1d |
| nodejs-packaging-bundler | RHEL 9 | 0:2021.06-6.module+el9.8.0+24708+e71d2e1d |
| npm | RHEL 9 | 1:11.19.1-1.24.22.1.5.module+el9.8.0+25292+33251f3b |
| v8-13.6-devel | RHEL 9 | 3:13.6.233.17-1.24.22.1.5.module+el9.8.0+25292+33251f3b |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2026-109383 | node-undici: undici is an HTTP client library for Node.js | 9.1 | 0.0018 | None reported |
| High | CVE-2026-102278 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion | 8.1 | 0.0049 | None reported |
| High | CVE-2026-102276 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion | 8.1 | 0.0046 | None reported |
| High | CVE-2026-19534 | node-undici: undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with... | 7.8 | 0.0039 | None reported |
| High | CVE-2026-109869 | node-undici: undici is an HTTP client library for Node.js | 7.5 | 0.0034 | None reported |
| High | CVE-2026-118764 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.8 | 0.0030 | None reported |
| High | CVE-2026-119379 | SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind() | 7.8 | 0.0028 | None reported |
| High | CVE-2026-119374 | SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete() | 7.8 | 0.0023 | None reported |
| High | CVE-2026-87018 | node-undici: undici is an HTTP client library for Node.js | 7.5 | 0.0019 | None reported |
| High | CVE-2026-119373 | SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists() | 7.8 | 0.0016 | None reported |
Showing 1 to 10 of 10
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.