Red Hat Node.js 24.22.1 Update Fixes 13 CVEs
Tech GuruQuick Answer
Red Hat RHSA-2026:92378 rebases the RHEL 9 Node.js 24 module to 24.22.1 and fixes 13 CVEs. Inventory hosts, containers and applications, update the correct module stream, rebuild images, restart services, validate application behavior, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory RHEL 9 systems and images using the Node.js 24 module, exact module profiles and packages, Brotli use, applications, owners, repositories, and maintenance windows. Match deployments to the RHEL 9 nodejs:24 stream and individual issue prerequisites; do not infer that system Node.js or another distribution uses this build. Update the nodejs:24 stream to the signed 24.22.1-3 module build through the supported Red Hat repository, rebuild images, and restart services. Confirm module and running process versions, test TLS, filesystem, networking, compression and representative applications, scan images for stale runtimes, and retain evidence.
Last verified: 2026-10-30 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat Node.js 24 module on RHEL 9 |
|---|---|
| Advisory | RHSA-2026:92378 |
| CVEs | CVE-2026-101911, CVE-2026-102276, CVE-2026-102277, CVE-2026-102278, CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106071, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074, CVE-2026-111497 |
| Authoritative release date | 2026-10-29 22:34:48 UTC |
| Authority revision date | 2026-10-30 00:32:35 UTC |
| Affected versions | Advisory-listed packages on Red Hat Enterprise Linux AppStream (v. 9), before the exact fixed builds in the corresponding RHSA. |
| Fixed version | nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.src::nodejs:24 |
| CVSS base score | 3.3-8.1 (CVSS v3.1; advisory-specific) |
| CVSS severity | Low to High |
| Exploitation status | Red Hat does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
The Node.js 24 module update rebases to 24.22.1 and addresses 13 vulnerabilities, including Brotli and filesystem, network, and permission flaws. Red Hat rates the grouped errata Important; individual CVSS scores and prerequisites differ by CVE.
What To Validate Now
- Inventory. Inventory RHEL 9 systems and images using the Node.js 24 module, exact module profiles and packages, Brotli use, applications, owners, repositories, and maintenance windows.
- Establish applicability. Match deployments to the RHEL 9 nodejs:24 stream and individual issue prerequisites; do not infer that system Node.js or another distribution uses this build.
- Remediate. Update the nodejs:24 stream to the signed 24.22.1-3 module build through the supported Red Hat repository, rebuild images, and restart services.
- Validate. Confirm module and running process versions, test TLS, filesystem, networking, compression and representative applications, scan images for stale runtimes, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Module-stream changes and native dependencies can affect applications. Preserve the selected stream, test production workloads, and avoid mixing packages from other streams.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
