ALSA-2026:76750
Important: nodejs:22 security update
Published Oct 6, 2026 · updated Oct 15, 2026
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 6, 2026 · OSV.dev
Detected
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), inclu
Oct 15, 2026 · OSV.dev
Fix available
nodejs fixed in 1:22.23.2-2.module_el9.8.0+322+f4aa738c; nodejs-devel fixed in 1:22.23.2-2.module_el9.8.0+322+f4aa738c; nodejs-docs fixed in 1:22.23.2-2.module_el9.8.0+322+f4aa738c; nodejs-full-i18n fixed in 1:22.23.2-2.module_el9.8.0+322+f4aa738c
Oct 15, 2026 · OSV.dev
Fix available
nodejs fixed in 1:22.23.2-2.module_el9.8.0+322+f4aa738c
Oct 15, 2026 · OSV.dev
Fix available
nodejs-devel fixed in 1:22.23.2-2.module_el9.8.0+322+f4aa738c
Oct 15, 2026 · OSV.dev
Fix available
nodejs-docs fixed in 1:22.23.2-2.module_el9.8.0+322+f4aa738c
Oct 15, 2026 · OSV.dev
Fix available
nodejs-full-i18n fixed in 1:22.23.2-2.module_el9.8.0+322+f4aa738c
Oct 15, 2026 · OSV.dev
Fix available
nodejs-libs fixed in 1:22.23.2-2.module_el9.8.0+322+f4aa738c
Oct 15, 2026 · OSV.dev
Fix available
nodejs-nodemon fixed in 3.1.14-2.module_el9.8.0+302+959ebcd4
Oct 15, 2026 · OSV.dev
Fix available
nodejs-packaging fixed in 2021.06-6.module_el9.7.0+227+12323393
Oct 15, 2026 · OSV.dev
Fix available
nodejs-packaging-bundler fixed in 2021.06-6.module_el9.7.0+227+12323393
Oct 15, 2026 · OSV.dev
Fix available
npm fixed in 1:10.9.8-1.22.23.2.2.module_el9.8.0+322+f4aa738c
Oct 15, 2026 · OSV.dev
Fix available
v8-12.4-devel fixed in 3:12.4.254.21-1.22.23.2.2.module_el9.8.0+322+f4aa738c
Oct 15, 2026 · OSV.dev
Updated
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function (CVE-2026-9496) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) For more details about the security issue(s), inclu
Affected
- AlmaLinux:9 nodejs0 → 1:22.23.2-2.module_el9.8.0+322+f4aa738c
- AlmaLinux:9 nodejs-devel0 → 1:22.23.2-2.module_el9.8.0+322+f4aa738c
- AlmaLinux:9 nodejs-docs0 → 1:22.23.2-2.module_el9.8.0+322+f4aa738c
- AlmaLinux:9 nodejs-full-i18n0 → 1:22.23.2-2.module_el9.8.0+322+f4aa738c
- AlmaLinux:9 nodejs-libs0 → 1:22.23.2-2.module_el9.8.0+322+f4aa738c
- AlmaLinux:9 nodejs-nodemon0 → 3.1.14-2.module_el9.8.0+302+959ebcd4
- AlmaLinux:9 nodejs-packaging0 → 2021.06-6.module_el9.7.0+227+12323393
- AlmaLinux:9 nodejs-packaging-bundler0 → 2021.06-6.module_el9.7.0+227+12323393
- AlmaLinux:9 npm0 → 1:10.9.8-1.22.23.2.2.module_el9.8.0+322+f4aa738c
- AlmaLinux:9 v8-12.4-devel0 → 3:12.4.254.21-1.22.23.2.2.module_el9.8.0+322+f4aa738c