Critical Security Update for Node.js: Denial of Service Vulnerabilities
Summary
RLSA-2026:76750: Important: nodejs:22 security update. Affects nodejs versions < 1:22.23.2-2.module+el9.8.0+40374+17512296. Fixed in 1:22.23.2-2.module+el9.8.0+40374+17512296. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and offers a rich ecosystem of libraries and tools. However, recent vulnerabilities have been identified that could potentially compromise the stability and security of applications built on this platform.
Vulnerability Detail
The identified vulnerabilities in Node.js stem from issues in the 'pacote' and 'undici' libraries. Specifically, the 'addGitSha' function in 'pacote' is susceptible to a Denial of Service (DoS) attack when it processes a crafted 'spec.rawSpec' value. Similarly, the 'undici' library can be exploited through an unrequested WebSocket subprotocol, leading to potential service disruptions. These vulnerabilities could allow attackers to overwhelm the application, causing it to become unresponsive and impacting user experience.
How To Fix
Minimum fixed version
1:22.23.2-2.module+el9.8.0+40374+17512296
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider implementing rate limiting on your application to mitigate the impact of potential DoS attacks. Additionally, review and sanitize inputs to the 'addGitSha' function to prevent crafted values from being processed.
Conclusion
In summary, the recent vulnerabilities identified in Node.js pose significant risks, particularly in terms of Denial of Service attacks. It is crucial for developers to promptly update their packages to the latest patched versions to safeguard their applications. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
These vulnerabilities can lead to Denial of Service attacks, causing your application to become unresponsive and negatively affecting user experience.
While specific exploits have not been publicly disclosed, the nature of the vulnerabilities suggests that they could be easily exploited by attackers to disrupt services.
If you cannot update immediately, consider implementing rate limiting and input validation as temporary measures to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
