Critical Security Update for Node.js: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:35891: Important: nodejs:24 security, bug fix, and enhancement update. Affects nodejs versions < 1:24.18.0-1.module_el9.8.0+277+61fc613e. Fixed in 1:24.18.0-1.module_el9.8.0+277+61fc613e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and offers a rich ecosystem of libraries and tools. However, recent vulnerabilities have been identified that could potentially compromise the security and integrity of applications built on this platform.
Vulnerability Detail
The vulnerabilities in Node.js stem from various components, including the ip-address and undici libraries, which expose applications to risks such as cross-site scripting, denial of service, information disclosure, and unauthorized file modifications. These vulnerabilities can lead to severe consequences, including data breaches, service disruptions, and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1:24.18.0-1.module_el9.8.0+277+61fc613e
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization to mitigate cross-site scripting risks, and limit the use of untrusted WebSocket connections to reduce the potential for denial of service attacks.
Conclusion
In summary, the recent vulnerabilities discovered in Node.js pose significant risks to applications built on this platform. It is crucial to update to the latest patched versions of Node.js and its related packages to ensure the security and integrity of your applications. Utilizing tools like Vulert can further enhance your ability to monitor and address vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities include cross-site scripting, denial of service, information disclosure, and unauthorized file modifications, primarily due to issues in the ip-address and undici libraries.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply using a manifest file like package-lock.json, you can check your application for vulnerabilities without needing to install any software.
Failure to address these vulnerabilities can lead to data breaches, service disruptions, and unauthorized access to sensitive information, potentially harming your application's reputation and user trust.
Yes, you should update nodejs, nodejs-devel, nodejs-docs, nodejs-full-i18n, nodejs-libs, and npm to the specified patched versions to mitigate the vulnerabilities.
Vulert is a tool that helps monitor and alert for open-source vulnerabilities in your software. You can use the Vulert playground to check if your application is affected by vulnerabilities without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
