Critical Security Update for Node.js: Addressing Multiple Vulnerabilities
Summary
RLSA-2026:55601: Important: nodejs:22 security update. Affects nodejs versions < 1:22.23.1-3.module+el9.8.0+40280+057606e8. Fixed in 1:22.23.1-3.module+el9.8.0+40280+057606e8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development due to its non-blocking architecture and efficient performance. However, recent vulnerabilities have been identified that could lead to severe security risks, including arbitrary code execution and denial of service.
Vulnerability Detail
The vulnerabilities stem from various components within Node.js, particularly affecting SQLite and brace-expansion libraries. Notably, CVE-2026-11822 and CVE-2026-11824 allow for arbitrary code execution through crafted full-text search data and heap-based buffer overflows, respectively. Additionally, CVE-2026-14257 and CVE-2026-69152 expose the system to denial of service attacks due to memory exhaustion and unbounded intermediate arrays. Lastly, CVE-2026-69192 presents a risk of server-side request forgery (SSRF) due to inconsistent IP address parsing, which can lead to trust-boundary bypass.
How To Fix
Minimum fixed version
1:22.23.1-3.module+el9.8.0+40280+057606e8
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider implementing network security measures to limit exposure to affected components. Additionally, monitor application logs for unusual activities that may indicate exploitation attempts.
Conclusion
In summary, the recent vulnerabilities in Node.js pose significant security risks that require immediate attention. Updating to the latest patched versions of the affected packages is essential to mitigate these risks. Users are encouraged to monitor their applications and utilize tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for nodejs →
FAQ
The main vulnerabilities include arbitrary code execution, denial of service, and server-side request forgery, primarily affecting SQLite and brace-expansion libraries.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
The CVSS score for these vulnerabilities is 8.6, indicating a high level of severity.
If you cannot update immediately, implement network security measures and monitor application logs for any unusual activities.
More information can be found on the CVE pages listed in the vulnerability details, which provide insights into the impact and technical aspects.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
