This Red Hat security update addresses three denial-of-service vulnerabilities in Node.js 24: an exponential-time complexity issue in brace-expansion (CVE-2026-13149), and two issues in the `tar` library allowing DoS via a malformed tar archive header (CVE-2026-59874, CVSS 7.5) or a crafted gzip bomb (CVE-2026-59873, CVSS 7.5). The vulnerabilities affect the `isaacs tar` library versions prior to 7.5.18 for CVE-2026-59874 and prior to 7.5.19 for CVE-2026-59873. The fix is applied via the updated `nodejs24` packages for Red Hat Enterprise Linux 10.
Red Hat Product Errata RHSA-2026:48034 - Security Advisory Issued: 2026-07-29 Updated: 2026-07-29 RHSA-2026:48034 - Security Advisory Overview Updated Packages Synopsis Important: nodejs24 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for nodejs24 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149) tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874) tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2494813 - CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity BZ - 2498116 - CVE-2026-59874 tar: Node-tar: Denial of Service via malformed tar archive header BZ - 2498120 - CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb CVEs CVE-2026-13149 CVE-2026-59873 CVE-2026-59874 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM nodejs24-24.18.0-3.el10_2.src.rpm SHA-256: a7685f7c985baf7212806094751956caec11d69af0c8792af11bb622a6442e5e x86_64 nodejs24-24.18.0-3.el10_2.x86_64.rpm SHA-256: 0bd60fe2913475b9a4695a471c97d5987cebdb44f1c2189dc4f72b2da86908e5 nodejs24-debuginfo-24.18.0-3.el10_2.x86_64.rpm SHA-256: 2891b3c8197e11edc4f9e22256a4aded93dc1da18c20b8c866534a24c247f3e6 nodejs24-debugsource-24.18.0-3.el10_2.x86_64.rpm SHA-256: 511c95be2f50bd8121640609b21d84c65f4f1c8f47caacfb28f57e1b8eb76a2d nodejs24-devel-24.18.0-3.el10_2.x86_64.rpm SHA-256: ee7c84a012fbfec1317626c3641fe557f1d4da681cf241a569231cc7d1b41415 nodejs24-docs-24.18.0-3.el10_2.noarch.rpm SHA-256: baa341a205f03a0832c0ff51320252ad4e7217f05c4c89c1de18fc0652389b28 nodejs24-full-i18n-24.18.0-3.el10_2.x86_64.rpm SHA-256: c4d2afcfdc56d708b6c4c4aa626eb92e61ad40aa4f72bbce5aad9851f62ac5ff nodejs24-libs-24.18.0-3.el10_2.x86_64.rpm SHA-256: 193aa8b42f3aee6bde8594d58c1c64d149f5e3fc94597bbbbb724e9e842fcc13 nodejs24-libs-debuginfo-24.18.0-3.el10_2.x86_64.rpm SHA-256: 96b25d04d945eb5a47f4d58973923b523c7b384fd3eb905f33f550f0dc03e63c nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm SHA-256: 9894cc976fc0f2ae27ba51bde0db4fdb37e43b1bf02b2f512b6b15717310df82 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 SRPM nodejs24-24.18.0-3.el10_2.src.rpm SHA-256: a7685f7c985baf7212806094751956caec11d69af0c8792af11bb622a6442e5e x86_64 nodejs24-24.18.0-3.el10_2.x86_64.rpm SHA-256: 0bd60fe2913475b9a4695a471c97d5987cebdb44f1c2189dc4f72b2da86908e5 nodejs24-debuginfo-24.18.0-3.el10_2.x86_64.rpm SHA-256: 2891b3c8197e11edc4f9e22256a4aded93dc1da18c20b8c866534a24c247f3e6 nodejs24-debugsource-24.18.0-3.el10_2.x86_64.rpm SHA-256: 511c95be2f50bd8121640609b21d84c65f4f1c8f47caacfb28f57e1b8eb76a2d nodejs24-devel-24.18.0-3.el10_2.x86_64.rpm SHA-256: ee7c84a012fbfec1317626c3641fe557f1d4da681cf241a569231cc7d1b41415 nodejs24-docs-24.18.0-3.el10_2.noarch.rpm SHA-256: baa341a205f03a0832c0ff51320252ad4e7217f05c4c89c1de18fc0652389b28 nodejs24-full-i18n-24.18.0-3.el10_2.x86_64.rpm SHA-256: c4d2afcfdc56d708b6c4c4aa626eb92e61ad40aa4f72bbce5aad9851f62ac5ff nodejs24-libs-24.18.0-3.el10_2.x86_64.rpm SHA-256: 193aa8b42f3aee6bde8594d58c1c64d149f5e3fc94597bbbbb724e9e842fcc13 nodejs24-libs-debuginfo-24.18.0-3.el10_2.x86_64.rpm SHA-256: 96b25d04d945eb5a47f4d58973923b523c7b384fd3eb905f33f550f0dc03e63c nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm SHA-256: 9894cc976fc0f2ae27ba51bde0db4fdb37e43b1bf02b2f512b6b15717310df82 Red Hat Enterprise Linux for IBM z Systems 10 SRPM nodejs24-24.18.0-3.el10_2.src.rpm SHA-256: a7685f7c985baf7212806094751956caec11d69af0c8792af11bb622a6442e5e s390x nodejs24-24.18.0-3.el10_2.s390x.rpm SHA-256: de225d7a520bca38648d31fb38d5d45b1934e822b935269e027abcf41c711bc0 nodejs24-debuginfo-24.18.0-3.el10_2.s390x.rpm SHA-256: 4cc0a30ce1d9b85c9db86ed9900afcef6216934f1473fd41f6531bdc7551c92c nodejs24-debugsource-24.18.0-3.el10_2.s390x.rpm SHA-256: 0919276315467822a9ed0eec603c6ed3d564dcb16f9f714ef96c88445542ce90 nodejs24-devel-24.18.0-3.el10_2.s390x.rpm SHA-256: 105cbacb3e5e2e571a83fa506dbc86fe73ee3476186be308d06973703f882c56 nodejs24-docs-24.18.0-3.el10_2.noarch.rpm SHA-256: baa341a205f03a0832c0ff51320252ad4e7217f05c4c89c1de18fc0652389b28 nodejs24-full-i18n-24.18.0-3.el10_2.s390x.rpm SHA-256: 694017361179648e9b482c02d175d838b64dfd7ad4df06824891b479cf6137ab nodejs24-libs-24.18.0-3.el10_2.s390x.rpm SHA-256: c55bc312bf29663887d2fa0fbfdd671b4b1d9f6ad08e597757f818acadb7291c nodejs24-libs-debuginfo-24.18.0-3.el10_2.s390x.rpm SHA-256: dc6ba71dbec51627e2e989b90b032d3ce02e65eee4d5c4835f7ab042821d8d18 nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm SHA-256: 9894cc976fc0f2ae27ba51bde0db4fdb37e43b1bf02b2f512b6b15717310df82 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 SRPM nodejs24-24.18.0-3.el10_2.src.rpm SHA-256: a7685f7c985baf7212806094751956caec11d69af0c8792af11bb622a6442e5e s390x nodejs24-24.18.0-3.el10_2.s390x.rpm SHA-256: de225d7a520bca38648d31fb38d5d45b1934e822b935269e027abcf41c711bc0 nodejs24-debuginfo-24.18.0-3.el10_2.s390x.rpm SHA-256: 4cc0a30ce1d9b85c9db86ed9900afcef6216934f1473fd41f6531bdc7551c92c nodejs24-debugsource-24.18.0-3.el10_2.s390x.rpm SHA-256: 0919276315467822a9ed0eec603c6ed3d564dcb16f9f714ef96c88445542ce90 nodejs24-devel-24.18.0-3.el10_2.s390x.rpm SHA-256: 105cbacb3e5e2e571a83fa506dbc86fe73ee3476186be308d06973703f882c56 nodejs24-docs-24.18.0-3.el10_2.noarch.rpm SHA-256: baa341a205f03a0832c0ff51320252ad4e7217f05c4c89c1de18fc0652389b28 nodejs24-full-i18n-24.18.0-3.el10_2.s390x.rpm SHA-256: 694017361179648e9b482c02d175d838b64dfd7ad4df06824891b479cf6137ab nodejs24-libs-24.18.0-3.el10_2.s390x.rpm SHA-256: c55bc312bf29663887d2fa0fbfdd671b4b1d9f6ad08e597757f818acadb7291c nodejs24-libs-debuginfo-24.18.0-3.el10_2.s390x.rpm SHA-256: dc6ba71dbec51627e2e989b90b032d3ce02e65eee4d5c4835f7ab042821d8d18 nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm SHA-256: 9894cc976fc0f2ae27ba51bde0db4fdb37e43b1bf02b2f512b6b15717310df82 Red Hat Enterprise Linux for Power, little endian 10 SRPM nodejs24-24.18.0-3.el10_2.src.rpm SHA-256: a7685f7c985baf7212806094751956caec11d69af0c8792af11bb622a6442e5e ppc64le nodejs24-24.18.0-3.el10_2.ppc64le.rpm SHA-256: f3fbacf0f2bb8c38dc16b4a4728271a3dce077fe0188b7413a91345f2e99f20d nodejs24-debuginfo-24.18.0-3.el10_2.ppc64le.rpm SHA-256: 6a0267ea7533b4f572c5a5df6cede551e40d5c0e383ace2e518346af328bf891 nodejs24-debugsource-24.18.0-3.el10_2.ppc64le.rpm SHA-256: e9b9a62cbc63bcb36dce11ced6908c01b34d56441981d17beee5c1e94b35d25f nodejs24-devel-24.18.0-3.el10_2.ppc64le.rpm SHA-256: 658bbb981704bada899e413c2966edbdcb176f78d57b711044ff101d1069892a nodejs24-docs-24.18.0-3.el10_2.noarch.rpm SHA-256: baa341a205f03a0832c0ff51320252ad4e7217f05c4c89c1de18fc0652389b28 nodejs24-full-i18n-24.18.0-3.el10_2.ppc64le.rpm SHA-256: 274bdf205f18878640dc7f55c87faa73221dcc270a1c999acfe8f2ee6f2cb423 nodejs24-libs-24.18.0-3.el10_2.ppc64le.rpm SHA-256: 1afb23990c7a9dfd25b6d182f1de61635e1c2f55a2192d0f4db810f3ebcadeea nodejs24-libs-debuginfo-24.18.0-3.el10_2.ppc64le.rpm SHA-256: 60a806bcd43a24e9abb3b48fb318631b45f0267d512883afc696bd0dbfa477a8 nodejs24-npm-11.16.0-1.24.18.0.3.el10_2.noarch.rpm SHA-256: 9894cc976fc0f2ae27ba51bde0db4fdb37e43b1bf02b2f512b6b15717310df82 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 SRPM nodejs24-24.18.0-3.el10_2.src.rpm SHA-256: a7685f7c985baf7212806094751956caec11d69af0c8792af11bb622a6442e5e ppc64le nodejs24-24.18.0-3.el10_2.ppc64le.rpm SHA-256: f3fbacf0f2bb8c38dc16b4a4728271a3dce077fe0188b7413a91345f2e99f20d nodejs24-debuginfo-24.18.0-3.el10_2.ppc64le.rpm SHA-256: 6a0267ea7533b4f572c5a5df6cede551e40d5c0e383ace2e518346af32