Critical Security Update for Node.js: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:55601: Important: nodejs:22 security update. Affects nodejs versions < 1:22.23.1-3.module_el9.8.0+291+0bb98cce. Fixed in 1:22.23.1-3.module_el9.8.0+291+0bb98cce. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and offers a rich ecosystem of libraries and tools. However, recent vulnerabilities have been identified that could compromise the security of applications built on this platform, necessitating immediate attention from developers and system administrators.
Vulnerability Detail
The vulnerabilities identified in Node.js include arbitrary code execution and denial of service attacks stemming from issues in various components such as SQLite and brace-expansion. Specifically, CVE-2026-11822 and CVE-2026-11824 allow for arbitrary code execution via crafted FTS5 full-text search data and heap-based buffer overflow, respectively. Additionally, CVE-2026-14257 and CVE-2026-69152 expose applications to denial of service through memory exhaustion and unbounded intermediate arrays. Lastly, CVE-2026-69192 highlights a risk of server-side request forgery due to inconsistent IP address parsing, which could lead to trust-boundary bypass.
How To Fix
Minimum fixed version
1:22.23.1-3.module_el9.8.0+291+0bb98cce
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider implementing input validation and sanitization to mitigate the risks associated with these vulnerabilities. Additionally, restrict access to sensitive endpoints and monitor application logs for unusual activity.
Conclusion
The identified vulnerabilities in Node.js pose significant risks to applications built on this platform. It is crucial for developers and system administrators to update their packages to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities can lead to arbitrary code execution, denial of service, and server-side request forgery, potentially compromising the security of applications and data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check for vulnerabilities without requiring access to the code.
Implement workarounds such as input validation and restricting access to sensitive areas of your application until you can apply the necessary updates.
Detailed information about each vulnerability can be found on the respective CVE pages linked in the advisory.
Yes, Vulert provides a playground where you can check if your application is affected by vulnerabilities without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
