Critical Security Update for Node.js: Addressing Unauthorized Access and Memory Exhaustion Vulnerabilities
Summary
ALSA-2026:61386: Important: nodejs:24 security update. Affects nodejs versions < 1:24.19.0-1.module_el9.8.0+301+084fac05. Fixed in 1:24.19.0-1.module_el9.8.0+301+084fac05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and offers a rich ecosystem of libraries and tools. However, recent vulnerabilities have been identified that could compromise the security of applications built on this platform, particularly in versions prior to 1:24.19.0-1.module_el9.8.0+301+084fac05.
Vulnerability Detail
The vulnerabilities in Node.js stem from a flaw in the Permission Model enforcement, which allows unauthorized filesystem access (CVE-2026-58043). Additionally, there are issues related to remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846) and a heap-use-after-free condition in HTTP/2 handling that can lead to denial of service (CVE-2026-56848). These vulnerabilities can result in severe security breaches, including unauthorized data access and service disruptions.
How To Fix
Minimum fixed version
1:24.19.0-1.module_el9.8.0+301+084fac05
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing strict access controls and monitoring to mitigate unauthorized access risks. Additionally, limit the use of HTTP/2 features that may expose your application to memory exhaustion vulnerabilities until the update can be applied.
Conclusion
The identified vulnerabilities in Node.js pose significant risks to applications built on this platform. It is essential to update to the latest patched versions to safeguard against unauthorized access and service disruptions. Utilizing tools like Vulert can help monitor for vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities include unauthorized filesystem access, remote memory exhaustion, and heap-use-after-free conditions that can lead to denial of service.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Versions prior to 1:24.19.0-1.module_el9.8.0+301+084fac05 are affected by these vulnerabilities.
Implement strict access controls and monitoring, and limit the use of vulnerable features until you can apply the necessary updates.
Detailed information can be found on the CVE pages linked in the advisory, which provide insights into the impact and technical aspects of the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
