This Red Hat advisory addresses three Important-severity Denial of Service vulnerabilities in the Node.js 24 module for RHEL 8, specifically within the `brace-expansion` and `tar` (`isaacs tar`) packages. The CVSS 3.1 score for the two `tar` vulnerabilities (CVE-2026-59873 and CVE-2026-59874) is 7.5 (High), exploiting malformed archive headers and crafted gzip bombs. The `isaacs tar` library is affected in versions prior to 7.5.18 for CVE-2026-59874 and prior to 7.5.19 for CVE-2026-59873, requiring an update to those respective fixed versions.
Red Hat Product Errata RHSA-2026:47060 - Security Advisory Issued: 2026-07-28 Updated: 2026-07-28 RHSA-2026:47060 - Security Advisory Overview Updated Packages Synopsis Important: nodejs:24 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2494813 - CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity BZ - 2498116 - CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header BZ - 2498120 - CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb CVEs CVE-2026-13149 CVE-2026-59873 CVE-2026-59874 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM nodejs-24.18.0-2.module+el8.10.0+24562+090c6525.src.rpm SHA-256: 57981e097c8b621d581333d3a6f6611a84cd4f50743700bc9a69cb6786d176fd nodejs-nodemon-3.1.14-1.module+el8.10.0+24562+090c6525.src.rpm SHA-256: 71871dc19c12746b887350fd31a6c44faa3e3597494f4cbb078d572255b42077 nodejs-packaging-2021.06-6.module+el8.10.0+24562+090c6525.src.rpm SHA-256: 6559a2152097a0d8798f78d2c2371d3c1bba55d1e59d2ff2c5033b38f65ebbcc x86_64 nodejs-docs-24.18.0-2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: b8ca6f5fb9e15a0b6c58a60a8cd3592a768be1f799fe3e9930a646ac221260da nodejs-nodemon-3.1.14-1.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 03c74c856fdcfb0a31872944ba6cdf423fd4161a4f0be2a611c62083ae8deeb8 nodejs-packaging-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: d0acf95e1be2647577f3daf417be1c249e98a14089b083f683c161af078d06b4 nodejs-packaging-bundler-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 7312d437faab1f0316001249e78288c0c5bac8039a67516bdd29e7fedbfd1e91 npm-11.16.0-1.24.18.0.2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: f45373be8dd1a9ddef9f093908ed1384872624db3d9c13fe14d52242bdae9151 nodejs-24.18.0-2.module+el8.10.0+24562+090c6525.x86_64.rpm SHA-256: 8ca91e52a355ed638258f7a25d633a518840b32f7e70f53a954878d372f1c8b0 nodejs-debuginfo-24.18.0-2.module+el8.10.0+24562+090c6525.x86_64.rpm SHA-256: 69fadea7b1e8d967526b37be2930425ef516fdae02fafe4a06ee6989ce47fb0b nodejs-debugsource-24.18.0-2.module+el8.10.0+24562+090c6525.x86_64.rpm SHA-256: f740cd6af64d1e39316ece43e3a44ca9a25ecf0749e79bd12941e601a0915f36 nodejs-devel-24.18.0-2.module+el8.10.0+24562+090c6525.x86_64.rpm SHA-256: a47391f9611fe7e10b43492619925aedf910a438cacc36e843c954ac0a5ea510 nodejs-docs-24.18.0-2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: b8ca6f5fb9e15a0b6c58a60a8cd3592a768be1f799fe3e9930a646ac221260da nodejs-full-i18n-24.18.0-2.module+el8.10.0+24562+090c6525.x86_64.rpm SHA-256: ff2524d82f2c8080c9b0a721ff92643618992e7c7d45305a6ec9132bca24ed4b nodejs-libs-24.18.0-2.module+el8.10.0+24562+090c6525.x86_64.rpm SHA-256: 86f5ed632c77ebfaa444537e83b4ff85b79675622923865214a4cdb0de921556 nodejs-libs-debuginfo-24.18.0-2.module+el8.10.0+24562+090c6525.x86_64.rpm SHA-256: 34a3462a6af475141a47e257a78032ba590577657c73021434f4343b3158ed0d nodejs-nodemon-3.1.14-1.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 03c74c856fdcfb0a31872944ba6cdf423fd4161a4f0be2a611c62083ae8deeb8 nodejs-packaging-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: d0acf95e1be2647577f3daf417be1c249e98a14089b083f683c161af078d06b4 nodejs-packaging-bundler-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 7312d437faab1f0316001249e78288c0c5bac8039a67516bdd29e7fedbfd1e91 npm-11.16.0-1.24.18.0.2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: f45373be8dd1a9ddef9f093908ed1384872624db3d9c13fe14d52242bdae9151 v8-13.6-devel-13.6.233.17-1.24.18.0.2.module+el8.10.0+24562+090c6525.x86_64.rpm SHA-256: 0612e7f1b306dc5c6822667aeca6613ab3b5c8ab6955a562f4771b3490efe07a nodejs-docs-24.18.0-2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: b8ca6f5fb9e15a0b6c58a60a8cd3592a768be1f799fe3e9930a646ac221260da nodejs-nodemon-3.1.14-1.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 03c74c856fdcfb0a31872944ba6cdf423fd4161a4f0be2a611c62083ae8deeb8 nodejs-packaging-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: d0acf95e1be2647577f3daf417be1c249e98a14089b083f683c161af078d06b4 nodejs-packaging-bundler-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 7312d437faab1f0316001249e78288c0c5bac8039a67516bdd29e7fedbfd1e91 npm-11.16.0-1.24.18.0.2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: f45373be8dd1a9ddef9f093908ed1384872624db3d9c13fe14d52242bdae9151 nodejs-docs-24.18.0-2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: b8ca6f5fb9e15a0b6c58a60a8cd3592a768be1f799fe3e9930a646ac221260da nodejs-nodemon-3.1.14-1.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 03c74c856fdcfb0a31872944ba6cdf423fd4161a4f0be2a611c62083ae8deeb8 nodejs-packaging-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: d0acf95e1be2647577f3daf417be1c249e98a14089b083f683c161af078d06b4 nodejs-packaging-bundler-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 7312d437faab1f0316001249e78288c0c5bac8039a67516bdd29e7fedbfd1e91 npm-11.16.0-1.24.18.0.2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: f45373be8dd1a9ddef9f093908ed1384872624db3d9c13fe14d52242bdae9151 Red Hat Enterprise Linux for IBM z Systems 8 SRPM nodejs-24.18.0-2.module+el8.10.0+24562+090c6525.src.rpm SHA-256: 57981e097c8b621d581333d3a6f6611a84cd4f50743700bc9a69cb6786d176fd nodejs-nodemon-3.1.14-1.module+el8.10.0+24562+090c6525.src.rpm SHA-256: 71871dc19c12746b887350fd31a6c44faa3e3597494f4cbb078d572255b42077 nodejs-packaging-2021.06-6.module+el8.10.0+24562+090c6525.src.rpm SHA-256: 6559a2152097a0d8798f78d2c2371d3c1bba55d1e59d2ff2c5033b38f65ebbcc s390x nodejs-docs-24.18.0-2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: b8ca6f5fb9e15a0b6c58a60a8cd3592a768be1f799fe3e9930a646ac221260da nodejs-nodemon-3.1.14-1.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 03c74c856fdcfb0a31872944ba6cdf423fd4161a4f0be2a611c62083ae8deeb8 nodejs-packaging-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: d0acf95e1be2647577f3daf417be1c249e98a14089b083f683c161af078d06b4 nodejs-packaging-bundler-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 7312d437faab1f0316001249e78288c0c5bac8039a67516bdd29e7fedbfd1e91 npm-11.16.0-1.24.18.0.2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: f45373be8dd1a9ddef9f093908ed1384872624db3d9c13fe14d52242bdae9151 nodejs-docs-24.18.0-2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: b8ca6f5fb9e15a0b6c58a60a8cd3592a768be1f799fe3e9930a646ac221260da nodejs-nodemon-3.1.14-1.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 03c74c856fdcfb0a31872944ba6cdf423fd4161a4f0be2a611c62083ae8deeb8 nodejs-packaging-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: d0acf95e1be2647577f3daf417be1c249e98a14089b083f683c161af078d06b4 nodejs-packaging-bundler-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 7312d437faab1f0316001249e78288c0c5bac8039a67516bdd29e7fedbfd1e91 npm-11.16.0-1.24.18.0.2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: f45373be8dd1a9ddef9f093908ed1384872624db3d9c13fe14d52242bdae9151 nodejs-docs-24.18.0-2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: b8ca6f5fb9e15a0b6c58a60a8cd3592a768be1f799fe3e9930a646ac221260da nodejs-nodemon-3.1.14-1.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 03c74c856fdcfb0a31872944ba6cdf423fd4161a4f0be2a611c62083ae8deeb8 nodejs-packaging-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: d0acf95e1be2647577f3daf417be1c249e98a14089b083f683c161af078d06b4 nodejs-packaging-bundler-2021.06-6.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: 7312d437faab1f0316001249e78288c0c5bac8039a67516bdd29e7fedbfd1e91 npm-11.16.0-1.24.18.0.2.module+el8.10.0+24562+090c6525.noarch.rpm SHA-256: f45373be8dd1a9ddef9f093908ed1384872624db3d9c13fe14d52242bdae9151 nodejs-24.18.0-2.module+el8.10.0+24562+090c6525.s390x.rpm SHA-256: 286c5168121511ff5e33e20a4a78d6731ac6838e1bf6a2b5c4b8dcf22758bc75 nodejs-debuginfo-24.18.0-2.module+el8.10.0+24562+090c6525.s390x.rpm SHA-256: bc13060508fbd11750dc30050215c11f811555f3fde1d1b7ffd37fbb27d29106 nodejs-debugsource-24.18.0-2.module+el8.10.0+24562+090c6525.s390x.rpm SHA-256: badbd1b5cc5a5eb22749f89bbb468d1d3c6f808698e242c6cb