Critical Security Update for Node.js 24: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:35841: Important: nodejs24 security, bug fix, and enhancement update. Affects nodejs24 versions < 1:24.18.0-1.el10_2. Fixed in 1:24.18.0-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified in Node.js 24, necessitating immediate attention to ensure the security and integrity of applications built on this platform.
Vulnerability Detail
The vulnerabilities in Node.js 24 stem from various components, including the 'ip-address' and 'undici' libraries. Issues range from cross-site scripting (CVE-2026-42338) to denial of service attacks (CVE-2026-12151) and unauthorized file metadata modifications (CVE-2026-48935). These vulnerabilities can lead to severe consequences, such as data breaches, service disruptions, and unauthorized access to sensitive information. The root causes include improper input handling, incorrect parsing of headers, and flaws in TLS handling, all of which compromise the security of applications relying on Node.js.
How To Fix
Minimum fixed version
1:24.18.0-1.el10_2
This is the first release that contains the fix.
sudo dnf update nodejs24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization to mitigate the risk of cross-site scripting and denial of service attacks. Additionally, review and restrict the use of WebSocket frames and ensure proper configuration of TLS options to prevent man-in-the-middle attacks.
Conclusion
The vulnerabilities identified in Node.js 24 pose significant risks to applications built on this platform. Immediate action is required to update to the patched version to safeguard against potential attacks. By following the recommended steps and utilizing tools like Vulert, developers can ensure their applications remain secure and resilient against emerging threats.
See every vulnerability recorded for nodejs24 →
FAQ
The vulnerabilities can lead to data breaches, service disruptions, and unauthorized access to sensitive information.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. Visit Vulert Scanner to check your application without any signup.
Implement input validation and sanitization, restrict WebSocket frame usage, and review TLS configurations as temporary measures.
Yes, notable vulnerabilities include cross-site scripting, denial of service, and unauthorized file metadata modifications.
Regularly check for updates, ideally on a monthly basis, or subscribe to security advisories to stay informed about critical patches.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs24.
