Critical Security Update for Node.js: Unauthorized Access and Denial of Service Vulnerabilities
Summary
ALSA-2026:62219: Important: nodejs:22 security update. Affects nodejs versions < 1:22.23.2-1.module_el8.10.0+4265+75d28086. Fixed in 1:22.23.2-1.module_el8.10.0+4265+75d28086. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and is known for its non-blocking, event-driven architecture, which makes it efficient for handling multiple connections simultaneously. However, recent vulnerabilities have been identified that could compromise the security of applications built on this platform, particularly affecting versions prior to 1:22.23.2-1.module_el8.10.0+4265+75d28086.
Vulnerability Detail
The vulnerabilities in Node.js stem from flaws in its permission model and HTTP/2 handling. Specifically, CVE-2026-58043 allows unauthorized filesystem access, which could lead to sensitive data exposure. Additionally, CVE-2026-56846 enables remote memory exhaustion through retained header blocks in HTTP/2, potentially leading to service disruption. Lastly, CVE-2026-56848 describes a heap-use-after-free condition in HTTP/2 handling that can result in denial of service, making applications unresponsive.
How To Fix
Minimum fixed version
1:22.23.2-1.module_el8.10.0+4265+75d28086
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing strict access controls and monitoring for unauthorized access attempts. Additionally, you can limit the use of HTTP/2 features that are known to be vulnerable until the update can be applied.
Conclusion
In summary, the identified vulnerabilities in Node.js pose significant risks to applications built on this platform. It is essential to update to the latest patched versions to mitigate these risks and ensure the security and stability of your applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The main vulnerabilities include unauthorized filesystem access, remote memory exhaustion, and heap-use-after-free conditions in HTTP/2 handling.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
These vulnerabilities can lead to unauthorized access to sensitive data, service disruptions, and denial of service, affecting the availability and integrity of applications.
It is recommended to regularly check for updates and apply them promptly, especially when security vulnerabilities are disclosed.
Yes, you can use Vulert's playground to monitor vulnerabilities without requiring installation. Just upload your manifest file to get started.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
