ALSA-2026:73838
Important: nodejs:24 security, bug fix, and enhancement update
Published Sep 30, 2026 · updated Oct 15, 2026
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152) * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961) * undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534) Bug Fix(es) and Enhancement(s): * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [almalinux-9.8.z] (JIRA:AlmaLinux-249189) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 30, 2026 · OSV.dev
Detected
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152) * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961) * undici: un
Oct 15, 2026 · OSV.dev
Fix available
nodejs fixed in 1:24.21.0-1.module_el9.8.0+321+1555b6a2; nodejs-devel fixed in 1:24.21.0-1.module_el9.8.0+321+1555b6a2; nodejs-docs fixed in 1:24.21.0-1.module_el9.8.0+321+1555b6a2; nodejs-full-i18n fixed in 1:24.21.0-1.module_el9.8.0+321+1555b6a2
Oct 15, 2026 · OSV.dev
Fix available
nodejs fixed in 1:24.21.0-1.module_el9.8.0+321+1555b6a2
Oct 15, 2026 · OSV.dev
Fix available
nodejs-devel fixed in 1:24.21.0-1.module_el9.8.0+321+1555b6a2
Oct 15, 2026 · OSV.dev
Fix available
nodejs-docs fixed in 1:24.21.0-1.module_el9.8.0+321+1555b6a2
Oct 15, 2026 · OSV.dev
Fix available
nodejs-full-i18n fixed in 1:24.21.0-1.module_el9.8.0+321+1555b6a2
Oct 15, 2026 · OSV.dev
Fix available
nodejs-libs fixed in 1:24.21.0-1.module_el9.8.0+321+1555b6a2
Oct 15, 2026 · OSV.dev
Fix available
nodejs-nodemon fixed in 3.1.14-3.module_el9.8.0+292+f4eaf8b2
Oct 15, 2026 · OSV.dev
Fix available
nodejs-packaging fixed in 2021.06-6.module_el9.7.0+209+ecf6523e
Oct 15, 2026 · OSV.dev
Fix available
nodejs-packaging-bundler fixed in 2021.06-6.module_el9.7.0+209+ecf6523e
Oct 15, 2026 · OSV.dev
Fix available
npm fixed in 1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2
Oct 15, 2026 · OSV.dev
Fix available
v8-13.6-devel fixed in 3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2
Oct 15, 2026 · OSV.dev
Updated
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152) * undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961) * undici: un
Affected
- AlmaLinux:9 nodejs0 → 1:24.21.0-1.module_el9.8.0+321+1555b6a2
- AlmaLinux:9 nodejs-devel0 → 1:24.21.0-1.module_el9.8.0+321+1555b6a2
- AlmaLinux:9 nodejs-docs0 → 1:24.21.0-1.module_el9.8.0+321+1555b6a2
- AlmaLinux:9 nodejs-full-i18n0 → 1:24.21.0-1.module_el9.8.0+321+1555b6a2
- AlmaLinux:9 nodejs-libs0 → 1:24.21.0-1.module_el9.8.0+321+1555b6a2
- AlmaLinux:9 nodejs-nodemon0 → 3.1.14-3.module_el9.8.0+292+f4eaf8b2
- AlmaLinux:9 nodejs-packaging0 → 2021.06-6.module_el9.7.0+209+ecf6523e
- AlmaLinux:9 nodejs-packaging-bundler0 → 2021.06-6.module_el9.7.0+209+ecf6523e
- AlmaLinux:9 npm0 → 1:11.19.0-1.24.21.0.1.module_el9.8.0+321+1555b6a2
- AlmaLinux:9 v8-13.6-devel0 → 3:13.6.233.17-1.24.21.0.1.module_el9.8.0+321+1555b6a2