Critical Security Update for Node.js: Authentication Bypass and Denial of Service Vulnerabilities
Summary
ALSA-2026:73838: Important: nodejs:24 security, bug fix, and enhancement update. Affects nodejs versions < 1:24.21.0-1.module_el9.8.0+321+1555b6a2. Fixed in 1:24.21.0-1.module_el9.8.0+321+1555b6a2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and offers features such as non-blocking I/O and an extensive package ecosystem through npm. However, recent vulnerabilities have been identified in Node.js, particularly in the undici library, which can lead to serious security issues if not addressed promptly.
Vulnerability Detail
The vulnerabilities in Node.js stem from issues in the undici library, which is responsible for HTTP/1.1 client functionality. The identified vulnerabilities include an authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152), a TLS certificate validation bypass in BalancedPool due to dropped connect options (CVE-2026-84961), and a Denial of Service (DoS) vulnerability via unrequested WebSocket subprotocol (CVE-2026-19534). These vulnerabilities can allow unauthorized access, data leakage, and service interruptions, posing significant risks to applications relying on Node.js.
How To Fix
Minimum fixed version
1:24.21.0-1.module_el9.8.0+321+1555b6a2
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing strict origin checks in your application to mitigate the risk of cross-origin cache poisoning. Additionally, avoid using unrequested WebSocket subprotocols until the update can be applied.
Conclusion
The recent vulnerabilities in Node.js highlight the importance of maintaining up-to-date software to protect against security threats. By promptly updating to the patched versions and implementing recommended workarounds, developers can safeguard their applications from potential exploits.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities can lead to unauthorized access, data leakage, and potential service disruptions, affecting the integrity and availability of applications.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
While updating is the best solution, you can implement strict origin checks and avoid unrequested WebSocket subprotocols as temporary workarounds.
Versions prior to 1:24.21.0-1.module_el9.8.0+321+1555b6a2 are affected by these vulnerabilities.
Detailed information can be found on the CVE pages linked in the advisory, as well as on the official Node.js and undici documentation.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
