Critical Security Update for Node.js: Addressing Unauthorized Access and Memory Exhaustion Vulnerabilities
Summary
ALSA-2026:61383: Important: nodejs:22 security update. Affects nodejs versions < 1:22.23.2-1.module_el9.8.0+302+959ebcd4. Fixed in 1:22.23.2-1.module_el9.8.0+302+959ebcd4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development due to its non-blocking I/O model and event-driven architecture, which allows for efficient handling of multiple connections. However, recent vulnerabilities have been identified that could compromise the security and stability of applications built on this platform.
Vulnerability Detail
The vulnerabilities in Node.js stem from flaws in its permission model and HTTP/2 handling. Specifically, CVE-2026-58043 allows unauthorized filesystem access, potentially exposing sensitive data. CVE-2026-56846 can lead to remote memory exhaustion through retained header blocks in HTTP/2, while CVE-2026-56848 involves a heap-use-after-free error that could result in denial of service. These vulnerabilities can severely impact application performance and security, making it crucial for developers to address them promptly.
How To Fix
Minimum fixed version
1:22.23.2-1.module_el9.8.0+302+959ebcd4
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to sensitive filesystem areas and monitoring HTTP/2 traffic for unusual patterns. Implementing rate limiting on your server can also help mitigate the impact of potential memory exhaustion attacks.
Conclusion
The identified vulnerabilities in Node.js pose significant risks to applications built on this platform. It is essential for developers to update their Node.js installations and related packages to the latest patched versions to ensure the security and stability of their applications. Utilizing tools like Vulert can further aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The main vulnerabilities include unauthorized filesystem access, remote memory exhaustion, and heap-use-after-free errors in HTTP/2 handling.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply using a manifest file like package-lock.json, you can check if your application is affected without needing to access the code.
Versions prior to 1:22.23.2-1.module_el9.8.0+302+959ebcd4 are affected by these vulnerabilities.
While updating is the best solution, you can implement access restrictions and monitor traffic as temporary workarounds.
Detailed information can be found on the CVE pages for CVE-2026-56846, CVE-2026-56848, and CVE-2026-58043.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
