Critical Security Update for Node.js: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:47057: Important: nodejs:24 security update. Affects nodejs versions < 1:24.18.0-3.module_el9.8.0+286+9023ffdb. Fixed in 1:24.18.0-3.module_el9.8.0+286+9023ffdb. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and offers a rich ecosystem of libraries and frameworks. However, like any software, Node.js can have vulnerabilities that may expose applications to security risks. This particular vulnerability affects multiple components of Node.js, including its libraries and development tools, making it crucial for developers to stay informed and updated.
Vulnerability Detail
The vulnerabilities identified in Node.js stem from issues in the brace-expansion and tar libraries. Specifically, CVE-2026-13149 presents a Denial of Service (DoS) risk due to exponential-time complexity in brace-expansion, which can lead to resource exhaustion. Additionally, CVE-2026-59873 and CVE-2026-59874 expose applications to DoS attacks via malformed tar archive headers and crafted gzip bombs, respectively. These vulnerabilities can be exploited by attackers to disrupt service availability, potentially leading to significant downtime and loss of user trust.
How To Fix
Minimum fixed version
1:24.18.0-3.module_el9.8.0+286+9023ffdb
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing rate limiting on your applications to mitigate the impact of potential DoS attacks. Additionally, validate and sanitize inputs to prevent malformed data from being processed.
Conclusion
The recent vulnerabilities identified in Node.js highlight the importance of maintaining up-to-date software to protect against potential security threats. By promptly applying the necessary updates and implementing recommended workarounds, developers can safeguard their applications from exploitation.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities primarily involve Denial of Service risks due to inefficient handling of inputs in certain libraries, which can lead to resource exhaustion.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of these vulnerabilities can lead to service downtime, degraded performance, and loss of user trust, which can have significant business implications.
Implementing rate limiting and input validation can help mitigate the risks associated with these vulnerabilities until a patch can be applied.
Detailed information about the vulnerabilities can be found on the CVE pages listed in the advisory, including their impact and CVSS scores.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
