RHSA-2026:87703HighCVSS 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 22, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (7)

CVE-2026-109932 →CVE-2026-87018 →CVE-2026-105482 →CVE-2026-105483 →CVE-2026-109383 →CVE-2026-109869 →CVE-2026-109924 →

📋 Description

CVE-2026-87018 — undici: undici: Denial of Service via TLS renegotiation with mismatched certificate CVE-2026-105482 — nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character CVE-2026-105483 — nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames CVE-2026-109383 — undici: undici: Certificate validation bypass via dropped TLS options in Agent CVE-2026-109869 — undici: undici: Denial of Service via unhandled stream error on excessive content encodings CVE-2026-109924 — undici: undici: Denial of Service via memory exhaustion in EventSource client CVE-2026-109932 — undici: undici: Denial of Service via unbounded WebSocket PONG buffering

🎯 Affected products29

  • Red Hat Hardened Images
  • nodejs26-1:26.12.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs26-1:26.12.1-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • nodejs26-1:26.12.1-0.1.hum1@src as a component of Red Hat Hardened Images
  • nodejs26-1:26.12.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • nodejs26-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • nodejs26-devel-1:26.12.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs26-devel-1:26.12.1-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • nodejs26-devel-1:26.12.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • nodejs26-docs-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • nodejs26-full-i18n-1:26.12.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs26-full-i18n-1:26.12.1-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • nodejs26-full-i18n-1:26.12.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs26-libs-1:26.12.1-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • nodejs26-libs-1:26.12.1-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • nodejs26-libs-1:26.12.1-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • nodejs26-npm-1:11.20.0-1.26.12.1.0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images
  • nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images
  • nodejs26-npm-bin-1:26.12.1-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images
  • v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@s390x as a component of Red Hat Hardened Images
  • v8-14.6-devel-3:14.6.202.34-1.26.12.1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate, do not pass untrusted strings into dns.resolve; reject hostnames that contain embedded NUL bytes before DNS resolution. Limit which components may perform DNS lookups on attacker-influenced names, and restrict network reachability of those services. Workaround: To mitigate do not pass untrusted hostnames that may contain non-ASCII or fullwidth digits into TLS clients such as tls.connect, https.request, or fetch. Restrict outbound TLS connections to trusted destinations only, and segment services that initiate TLS client connections from untrusted networks.

🔗 References (11)