Critical Denial of Service Vulnerabilities in Node.js Packaging
Summary
RLSA-2026:47059: Important: nodejs:22 security update. Affects nodejs-packaging across 3 version ranges.
< 0:2021.06-6.module+el8.10.0+40171+8fa9c325
< 0:2021.06-6.module+el8.10.0+40172+38f6fdd1
< 0:2021.06-6.module+el8.10.0+40048+6d99f608
Fixed in 0:2021.06-6.module+el8.10.0+40171+8fa9c325, 0:2021.06-6.module+el8.10.0+40172+38f6fdd1 or 0:2021.06-6.module+el8.10.0+40048+6d99f608, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side applications and is known for its event-driven architecture, which allows for non-blocking I/O operations. However, recent vulnerabilities have been identified in the nodejs-packaging that can lead to denial of service attacks, impacting the availability of applications built on this platform.
Vulnerability Detail
The vulnerabilities stem from issues in the brace-expansion and tar modules used within Node.js. Specifically, CVE-2026-13149 exposes applications to denial of service due to exponential-time complexity in brace-expansion. Additionally, CVE-2026-59873 and CVE-2026-59874 allow for denial of service through malformed tar archive headers and crafted gzip bombs, respectively. These vulnerabilities can lead to significant resource exhaustion, making applications unresponsive and potentially causing downtime.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-packaging-
< 0:2021.06-6.module+el8.10.0+40048+6d99f6080:2021.06-6.module+el8.10.0+40048+6d99f608 -
< 0:2021.06-6.module+el8.10.0+40171+8fa9c3250:2021.06-6.module+el8.10.0+40171+8fa9c325 -
< 0:2021.06-6.module+el8.10.0+40172+38f6fdd10:2021.06-6.module+el8.10.0+40172+38f6fdd1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can limit the resources allocated to your Node.js applications to mitigate the impact of these vulnerabilities. This can be done by adjusting the maximum memory limit or using a reverse proxy to manage incoming requests more effectively.
Conclusion
In summary, the identified vulnerabilities in the nodejs-packaging can lead to significant denial of service risks. It is crucial to update to the patched versions as soon as possible to maintain the integrity and availability of your applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs-packaging →
FAQ
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerabilities can lead to denial of service, causing applications to become unresponsive and potentially resulting in downtime.
Yes, updating to the patched versions of nodejs-packaging is the recommended permanent fix.
If an immediate update is not possible, consider implementing resource limits or using a reverse proxy as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-packaging.
