Critical Security Update for Node.js: Important Vulnerabilities Addressed
Summary
ALSA-2026:35892: Important: nodejs:22 security, bug fix, and enhancement update. Affects nodejs versions < 1:22.23.1-1.module_el9.8.0+276+8b329b47. Fixed in 1:22.23.1-1.module_el9.8.0+276+8b329b47. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely utilized for server-side development due to its non-blocking I/O model and event-driven architecture. The recent vulnerabilities identified in Node.js could potentially compromise the security and integrity of applications built on this platform, making it crucial for developers to stay informed and apply necessary updates.
Vulnerability Detail
The vulnerabilities in Node.js stem from various components, including the 'ip-address' and 'undici' libraries, which expose applications to risks such as cross-site scripting, denial of service, information disclosure, and unauthorized file modifications. These vulnerabilities can lead to severe consequences, including data breaches, application crashes, and unauthorized access to sensitive information. Specific issues include improper HTML escaping, unbounded memory growth, and certification validation bypasses, which can be exploited by attackers to compromise application security.
How To Fix
Minimum fixed version
1:22.23.1-1.module_el9.8.0+276+8b329b47
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While waiting for the update, consider implementing input validation and sanitization to mitigate the risk of cross-site scripting attacks. Additionally, monitor application performance to identify any unusual behavior that may indicate a denial of service attack.
Conclusion
In summary, the recent vulnerabilities identified in Node.js pose significant risks to applications built on this platform. It is crucial for developers to promptly update to the patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for vulnerabilities, ensuring that applications remain secure.
See every vulnerability recorded for nodejs →
FAQ
The update addresses multiple vulnerabilities, including cross-site scripting, denial of service, information disclosure, and unauthorized file modifications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without any signup.
The recommended version to update to is 1:22.23.1-1.module_el9.8.0+276+8b329b47 for Node.js.
If immediate updates are not possible, implement input validation and monitor application performance for unusual behavior.
For more details, refer to the CVE pages listed in the advisory, which provide in-depth information about each vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
