Critical Security Update for Node.js: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:47058: Important: nodejs:22 security update. Affects nodejs versions < 1:22.23.1-2.module_el9.8.0+285+5c3b0251. Fixed in 1:22.23.1-2.module_el9.8.0+285+5c3b0251. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and offers a rich ecosystem of libraries and frameworks. However, recent vulnerabilities have been identified that could potentially compromise the security and stability of applications built on this platform.
Vulnerability Detail
The vulnerabilities identified in Node.js stem from issues in the brace-expansion and tar packages. Specifically, CVE-2026-13149 exposes applications to Denial of Service (DoS) attacks due to exponential-time complexity in brace-expansion. Additionally, CVE-2026-59873 and CVE-2026-59874 allow for DoS attacks through malformed tar archive headers and crafted gzip bombs, respectively. These vulnerabilities can lead to service disruptions and degraded performance, posing significant risks to applications relying on Node.js.
How To Fix
Minimum fixed version
1:22.23.1-2.module_el9.8.0+285+5c3b0251
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing rate limiting and input validation to mitigate the risk of DoS attacks while waiting for the official patch. Additionally, avoid using untrusted input in brace-expansion and tar operations.
Conclusion
In summary, the identified vulnerabilities in Node.js pose significant risks to applications built on this platform. It is crucial to update to the latest patched versions to ensure security and stability. Utilizing tools like Vulert can help monitor for vulnerabilities in real-time, providing an additional layer of security.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities can lead to Denial of Service attacks, causing applications to become unresponsive or crash.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The vulnerabilities are associated with CVE-2026-13149, CVE-2026-59873, and CVE-2026-59874.
Implementing rate limiting and input validation can help mitigate the risks associated with these vulnerabilities.
For more details, refer to the CVE pages associated with the vulnerabilities or the official Node.js security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
