Important: nodejs:24 security update

🗓️ 12 Aug 2026 00:00:00Reported by AlmaLinuxType

almalinux🔗 errata.almalinux.org👁 11 Views

Node.js 24 update fixes SQLite RCE, brace-expansion DoS, and ip-address SSRF vulnerabilities.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	20 Aug 202615:19	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in brace-expansion	8 Sep 202609:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	15 Sep 202610:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cyber Fraud includes components with multiple known vulnerabilities	20 Aug 202614:58	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	22 Sep 202613:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Informix HQ is affected by multiple vulnerabilities in third-party libraries.	9 Sep 202621:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL	3 Sep 202623:55	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: Uncontrolled resource consumption, cross-site scripting, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	29 Sep 202600:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.16.tgz which is vulnerable to CVE-2026-14257.	27 Aug 202619:26	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
almalinux	8	noarch	npm	11.16.0-1.24.18.0.3.module_el8.10.0+4250+09238ed4	npm-11.16.0-1.24.18.0.3.module_el8.10.0+4250+09238ed4.noarch.rpm
almalinux	8	noarch	nodejs-packaging	2021.06-6.module_el8.10.0+4086+70facd4a	nodejs-packaging-2021.06-6.module_el8.10.0+4086+70facd4a.noarch.rpm
almalinux	8	noarch	nodejs-docs	24.18.0-3.module_el8.10.0+4250+09238ed4	nodejs-docs-24.18.0-3.module_el8.10.0+4250+09238ed4.noarch.rpm
almalinux	8	noarch	nodejs-nodemon	3.1.14-2.module_el8.10.0+4250+09238ed4	nodejs-nodemon-3.1.14-2.module_el8.10.0+4250+09238ed4.noarch.rpm
almalinux	8	noarch	nodejs-packaging-bundler	2021.06-6.module_el8.10.0+4086+70facd4a	nodejs-packaging-bundler-2021.06-6.module_el8.10.0+4086+70facd4a.noarch.rpm
almalinux	8	x86_64	nodejs-devel	24.18.0-3.module_el8.10.0+4250+09238ed4	nodejs-devel-24.18.0-3.module_el8.10.0+4250+09238ed4.x86_64.rpm
almalinux	8	x86_64	nodejs-full-i18n	24.18.0-3.module_el8.10.0+4250+09238ed4	nodejs-full-i18n-24.18.0-3.module_el8.10.0+4250+09238ed4.x86_64.rpm
almalinux	8	x86_64	nodejs	24.18.0-3.module_el8.10.0+4250+09238ed4	nodejs-24.18.0-3.module_el8.10.0+4250+09238ed4.x86_64.rpm
almalinux	8	x86_64	nodejs-libs	24.18.0-3.module_el8.10.0+4250+09238ed4	nodejs-libs-24.18.0-3.module_el8.10.0+4250+09238ed4.x86_64.rpm
almalinux	8	x86_64	v8-13.6-devel	13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4	v8-13.6-devel-13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4.x86_64.rpm

Source	Link
access	www.access.redhat.com/errata/RHSA-2026:54371
access	www.access.redhat.com/security/cve/CVE-2026-11822
access	www.access.redhat.com/security/cve/CVE-2026-11824
access	www.access.redhat.com/security/cve/CVE-2026-14257
access	www.access.redhat.com/security/cve/CVE-2026-54272
access	www.access.redhat.com/security/cve/CVE-2026-69152
access	www.access.redhat.com/security/cve/CVE-2026-69192
bugzilla	www.bugzilla.redhat.com/2506433
bugzilla	www.bugzilla.redhat.com/2507593
bugzilla	www.bugzilla.redhat.com/2510722

14 Sep 2026 08:27Current

7High risk

Vulners AI Score7

CVSS 3.17.8

CVSS 48.5

EPSS0.00663

SSVC

Node.js 24 SQLite FTS5 arbitrary code execution denial of service SSRF vulnerability brace-expansion ip-address