Critical Security Update for Node.js: Addressing Unauthorized Access and Memory Exhaustion Vulnerabilities
Summary
ALSA-2026:62583: Important: nodejs:24 security update. Affects nodejs versions < 1:24.19.0-1.module_el8.10.0+4268+8e07aa5a. Fixed in 1:24.19.0-1.module_el8.10.0+4268+8e07aa5a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and offers a rich ecosystem of libraries and tools. However, recent vulnerabilities have been identified that could compromise the security and stability of applications built on this platform.
Vulnerability Detail
The vulnerabilities in Node.js stem from flaws in its permission model and HTTP/2 handling. Specifically, CVE-2026-58043 allows unauthorized filesystem access, while CVE-2026-56846 can lead to remote memory exhaustion through retained header blocks. Additionally, CVE-2026-56848 presents a heap-use-after-free issue in HTTP/2 handling, potentially resulting in denial of service attacks. These vulnerabilities can severely impact application performance and security, making it crucial for developers to address them promptly.
How To Fix
Minimum fixed version
1:24.19.0-1.module_el8.10.0+4268+8e07aa5a
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the affected Node.js applications and monitoring for unusual activity. Implementing additional security measures, such as firewalls and intrusion detection systems, can help mitigate risks until the update is applied.
Conclusion
In summary, the recent vulnerabilities identified in Node.js pose significant risks to applications built on this platform. It is crucial for developers to update their Node.js installations and related packages to the latest patched versions to ensure the security and stability of their applications. Utilizing tools like Vulert can aid in monitoring and managing these vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The main vulnerabilities include unauthorized filesystem access, remote memory exhaustion, and heap-use-after-free issues in HTTP/2 handling.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
It is highly recommended to update to the patched version of Node.js and its related packages as soon as possible to mitigate the vulnerabilities.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests they could be exploited to compromise application security and stability.
For detailed information, refer to the CVE pages linked in the advisory, which provide insights into the vulnerabilities, their impact, and mitigation strategies.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
