Linux · Security advisory · April 15, 2026
RLSA-2026:7675: nodejs24 security update
RLSA-2026:7675, released April 15, 2026, fixes 18 CVEs in nodejs24 (version 1:24.14.1-2.el10_1). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
18
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.2544
97th percentile
Priority of the 18 CVEs
Patch now 0
Urgent 0
High 18
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| nodejs24 | rocky 10 | 1:24.14.1-2.el10_1 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2026-21710 | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** | 7.5 | 0.2544 | None reported | |
| High | CVE-2026-1526 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0120 | None reported | |
| High | CVE-2026-21637 | HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers | 7.5 | 0.0112 | N/A | |
| High | CVE-2026-2229 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0091 | None reported | |
| High | CVE-2026-27135 | nghttp2 Denial of service: Assertion failure due to the missing state validation | 7.5 | 0.0082 | None reported | |
| High | CVE-2026-2581 | nodejs-devel: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0059 | None reported | |
| High | CVE-2026-26996 | nodejs-libs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0058 | None reported | |
| High | CVE-2026-25547 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0054 | None reported | |
| High | CVE-2026-1525 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 9.8 | 0.0052 | None reported | |
| High | CVE-2026-1528 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0051 | None reported | |
| High | CVE-2026-21714 | Node.js 14 and 15 others: Missing Release of Memory after Effective Lifetime | 7.5 | 0.0043 | None reported | |
| High | CVE-2026-21713 | Node.js 14 and 15 others: Observable Timing Discrepancy | 7.5 | 0.0037 | None reported | |
| High | CVE-2026-21712 | A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process. | 7.5 | 0.0033 | None reported | |
| High | CVE-2026-1527 | nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog... | 7.5 | 0.0029 | None reported | |
| High | CVE-2026-21717 | A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. | 7.5 | 0.0027 | None reported | |
| High | CVE-2026-21711 | Node.js 14 and 12 others: Improper Access Control | 7.5 | 0.0017 | None reported | |
| High | CVE-2026-21715 | Node.js 14 and 15 others: Incorrect Permission Assignment for Critical Resource | 7.5 | 0.0015 | None reported | |
| High | CVE-2026-21716 | Node.js 14 and 15 others: Missing Authorization | 7.5 | 0.0014 | None reported |
Showing 1 to 18 of 18
1