Critical Security Update for Node.js: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:2782: Important: nodejs:22 security update. Affects nodejs versions < 1:22.22.0-1.module_el9.7.0+208+fb06c0ab. Fixed in 1:22.22.0-1.module_el9.7.0+208+fb06c0ab. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and has a rich ecosystem of libraries and frameworks. However, like any software, Node.js can be susceptible to vulnerabilities that may compromise its security and functionality. This report focuses on a significant security update that addresses multiple vulnerabilities affecting Node.js and its related packages in the AlmaLinux ecosystem.
Vulnerability Detail
The vulnerabilities identified in this update include a filesystem permissions bypass (CVE-2025-55132), multiple denial of service issues (CVE-2026-21637, CVE-2025-59466, CVE-2025-59465), and uninitialized memory exposure (CVE-2025-55131). These vulnerabilities could allow attackers to bypass security restrictions, cause service disruptions, or expose sensitive data, potentially leading to unauthorized access and exploitation of the affected systems.
How To Fix
Minimum fixed version
1:22.22.0-1.module_el9.7.0+208+fb06c0ab
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the affected Node.js applications and monitor for unusual activity until the packages are updated. Additionally, implementing rate limiting and input validation can help mitigate the impact of denial of service attacks.
Conclusion
In summary, the recent security update for Node.js addresses critical vulnerabilities that could compromise the security and functionality of applications built on this platform. It is crucial for users to update their packages promptly and consider implementing additional security measures to protect their systems.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities include filesystem permissions bypass, denial of service, and uninitialized memory exposure, which can lead to unauthorized access and service disruptions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring access to the code.
The vulnerabilities could allow attackers to bypass security measures, disrupt services, or expose sensitive data, leading to potential exploitation.
Yes, you can limit access to affected applications and implement rate limiting and input validation as temporary measures.
It is recommended to regularly check for updates and security advisories to ensure that your Node.js packages are up to date and secure.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
