Critical Security Update for Node.js: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:75870: Important: nodejs:22 security update. Affects nodejs versions < 1:22.23.2-2.module_el8.10.0+4296+737cb4d7. Fixed in 1:22.23.2-2.module_el8.10.0+4296+737cb4d7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It allows developers to create server-side applications with ease, leveraging non-blocking I/O operations for high performance. However, certain vulnerabilities have been identified in Node.js packages, specifically in the 'pacote' and 'undici' libraries, which can lead to Denial of Service (DoS) attacks if exploited.
Vulnerability Detail
The vulnerabilities stem from the 'pacote' and 'undici' libraries within Node.js. The 'pacote' library is susceptible to a Denial of Service attack through a crafted 'spec.rawSpec' value in the 'addGitSha' function (CVE-2026-9496). Similarly, the 'undici' library can be exploited via an unrequested WebSocket subprotocol, leading to potential service disruptions (CVE-2026-19534). These vulnerabilities can allow attackers to overwhelm the server, causing it to become unresponsive.
How To Fix
Minimum fixed version
1:22.23.2-2.module_el8.10.0+4296+737cb4d7
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing rate limiting on your server to mitigate the risk of Denial of Service attacks. This can help control the number of requests a user can make in a given timeframe, reducing the likelihood of server overload.
Conclusion
In summary, the identified vulnerabilities in Node.js pose significant risks, particularly in the form of Denial of Service attacks. It is crucial to update to the patched versions of the affected packages to ensure the security and stability of your applications. Utilizing tools like Vulert can further enhance your ability to monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities can lead to Denial of Service attacks, causing the application to become unresponsive and potentially affecting all users.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
The vulnerabilities are associated with CVE-2026-19534 and CVE-2026-9496.
Yes, implementing rate limiting on your server can help control the number of requests and reduce the risk of Denial of Service attacks.
For more details, refer to the CVE pages listed in the References section of the vulnerability advisory.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
