Critical Security Update for Node.js: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:47059: Important: nodejs:22 security update. Affects nodejs versions < 1:22.23.1-2.module_el8.10.0+4236+04bc75d9. Fixed in 1:22.23.1-2.module_el8.10.0+4236+04bc75d9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and is known for its event-driven architecture, which allows for non-blocking I/O operations. However, recent vulnerabilities have been identified that could lead to Denial of Service (DoS) attacks, affecting the performance and availability of applications built on this platform.
Vulnerability Detail
The vulnerabilities identified in Node.js stem from issues in the brace-expansion and tar modules. Specifically, CVE-2026-13149 exposes applications to Denial of Service due to exponential-time complexity in brace-expansion. Additionally, CVE-2026-59874 and CVE-2026-59873 relate to malformed tar archive headers and crafted gzip bombs, respectively, both of which can lead to resource exhaustion and application crashes. These vulnerabilities can be exploited by attackers to disrupt services, making it crucial for users to address them promptly.
How To Fix
Minimum fixed version
1:22.23.1-2.module_el8.10.0+4236+04bc75d9
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider implementing rate limiting on your application to mitigate the risk of DoS attacks. This can be done using middleware in your Node.js application, such as the 'express-rate-limit' package, which allows you to control the number of requests a user can make in a given timeframe.
Conclusion
In summary, the recent vulnerabilities discovered in Node.js pose significant risks, particularly in the form of Denial of Service attacks. It is imperative for developers and system administrators to update their Node.js installations and related packages to the latest patched versions to safeguard their applications. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for nodejs →
FAQ
A Denial of Service attack is a malicious attempt to disrupt the normal functioning of a targeted server, service, or network by overwhelming it with a flood of traffic or requests.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check if your application is affected without needing to install any software.
Failing to address these vulnerabilities can lead to service outages, degraded performance, and potential data loss, which can severely impact user experience and trust.
Yes, implementing rate limiting and other security measures can help mitigate the risks associated with these vulnerabilities until you can apply the necessary updates.
Detailed information about the vulnerabilities can be found on the respective CVE pages: CVE-2026-13149, CVE-2026-59873, and CVE-2026-59874.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
