Critical Security Update for Node.js: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:35842: Important: nodejs22 security, bug fix, and enhancement update. Affects nodejs versions < 1:22.23.1-2.el10_2. Fixed in 1:22.23.1-2.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified that could compromise the security and functionality of applications built on this platform.
Vulnerability Detail
The vulnerabilities in Node.js stem from various components such as 'ip-address' and 'undici', leading to issues like cross-site scripting, denial of service, and unauthorized access. Specific vulnerabilities include improper HTML escaping, unbounded memory growth, and silent authority rebinding. These vulnerabilities can result in data breaches, service disruptions, and unauthorized modifications, posing significant risks to applications relying on Node.js.
How To Fix
Minimum fixed version
1:22.23.1-2.el10_2
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While waiting for the update, consider implementing input validation and sanitization to mitigate the risk of cross-site scripting and other vulnerabilities. Additionally, monitor your application for unusual behavior that may indicate exploitation attempts.
Conclusion
In summary, the recent vulnerabilities identified in Node.js pose significant risks to applications built on this platform. It is crucial to update to the latest patched version to mitigate these risks and ensure the security and integrity of your applications.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities include cross-site scripting, denial of service, and unauthorized access due to improper handling of inputs and headers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Implement input validation and monitor your application for any suspicious activities as a temporary measure.
Yes, the vulnerabilities can lead to data breaches and service disruptions, making them critical to address promptly.
Detailed information can be found on the CVE pages linked in the vulnerability report, which provide insights into the impact and technical details.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
