Critical Security Update for Node.js: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:2421: Important: nodejs:22 security update. Affects nodejs versions < 1:22.22.0-1.module_el8.10.0+4112+db1af44b. Fixed in 1:22.22.0-1.module_el8.10.0+4112+db1af44b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source platform designed for building fast and scalable network applications using JavaScript. It enables developers to create server-side applications with a non-blocking, event-driven architecture. The platform is widely used for its efficiency and performance, but it is not immune to security vulnerabilities that can compromise applications built on it.
Vulnerability Detail
This security update addresses several vulnerabilities in Node.js, including filesystem permissions bypass, denial of service attacks, and uninitialized memory exposure. These vulnerabilities can lead to unauthorized access, application crashes, and potential data leaks, posing significant risks to applications relying on Node.js. The vulnerabilities are identified by CVE-2025-55132, CVE-2026-21637, CVE-2025-59466, CVE-2025-59465, CVE-2025-55131, and CVE-2025-55130.
How To Fix
Minimum fixed version
1:22.22.0-1.module_el8.10.0+4112+db1af44b
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing strict access controls and monitoring to mitigate the risks associated with these vulnerabilities. Additionally, you can use tools like Vulert to monitor your application for vulnerabilities without needing to access the code directly.
Conclusion
In summary, the recent security update for Node.js addresses critical vulnerabilities that could compromise applications built on this platform. It is crucial for developers and system administrators to update their Node.js installations and related packages to the latest patched versions to ensure the security and integrity of their applications.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities can lead to unauthorized access, application crashes, and potential data leaks, affecting the security and stability of applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without any signup.
All versions prior to '1:22.22.0-1.module_el8.10.0+4112+db1af44b' are affected by these vulnerabilities.
Yes, you can implement strict access controls and monitoring to reduce the risks associated with these vulnerabilities until you can perform the update.
After updating, ensure to test your applications thoroughly to confirm that they function correctly with the new version and that the vulnerabilities have been addressed.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
