Critical Security Update for Node.js: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:76750: Important: nodejs:22 security update. Affects nodejs versions < 1:22.23.2-2.module_el9.8.0+322+f4aa738c. Fixed in 1:22.23.2-2.module_el9.8.0+322+f4aa738c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful open-source platform designed for building fast and scalable network applications using JavaScript. It is widely used for developing server-side applications and APIs. The platform's non-blocking I/O model makes it efficient and suitable for data-intensive real-time applications. However, recent vulnerabilities have been identified that could potentially compromise the security of applications built on this platform.
Vulnerability Detail
The identified vulnerabilities in Node.js stem from issues in the 'pacote' and 'undici' packages. Specifically, a crafted 'spec.rawSpec' value in the 'addGitSha' function of 'pacote' can lead to a Denial of Service (DoS) attack (CVE-2026-9496). Additionally, 'undici' is susceptible to a DoS attack through unrequested WebSocket subprotocols (CVE-2026-19534). These vulnerabilities can be exploited by attackers to disrupt service availability, leading to potential downtime and loss of service for users.
How To Fix
Minimum fixed version
1:22.23.2-2.module_el9.8.0+322+f4aa738c
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the input to the affected functions or implement rate limiting on your server to mitigate the impact of potential DoS attacks until the packages are updated.
Conclusion
In summary, the recent vulnerabilities identified in Node.js pose significant risks that can lead to Denial of Service attacks. It is crucial for developers and system administrators to update their Node.js installations and related packages promptly to ensure the security and availability of their applications.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities are related to Denial of Service (DoS) attacks that can be triggered through specific functions in the 'pacote' and 'undici' packages.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of these vulnerabilities can lead to service disruptions, making applications unavailable to users, which can result in loss of revenue and trust.
Implementing input validation and rate limiting can help reduce the risk of exploitation until the packages are updated.
Detailed information about the vulnerabilities can be found on the CVE pages: CVE-2026-19534 and CVE-2026-9496.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
