Critical Security Update for Node.js: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:47060: Important: nodejs:24 security update. Affects nodejs versions < 1:24.18.0-2.module_el8.10.0+4237+cde4efc3. Fixed in 1:24.18.0-2.module_el8.10.0+4237+cde4efc3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and offers a rich ecosystem of libraries and tools. However, recent vulnerabilities have been identified that could lead to Denial of Service (DoS) attacks, affecting the stability and availability of applications built on this platform.
Vulnerability Detail
The vulnerabilities stem from issues in the 'brace-expansion' and 'node-tar' packages used within Node.js. Specifically, CVE-2026-13149 allows for a Denial of Service due to exponential-time complexity in brace-expansion, while CVE-2026-59873 and CVE-2026-59874 expose applications to Denial of Service attacks via malformed tar archive headers and crafted gzip bombs, respectively. These vulnerabilities can be exploited by attackers to overwhelm the server, leading to service outages.
How To Fix
Minimum fixed version
1:24.18.0-2.module_el8.10.0+4237+cde4efc3
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the input size for requests that utilize brace-expansion and tar functionalities to mitigate the risk of exploitation until the packages can be updated.
Conclusion
In summary, the identified vulnerabilities in Node.js pose significant risks of Denial of Service attacks. It is crucial for developers and system administrators to update their Node.js installations and related packages to the latest patched versions to ensure the security and stability of their applications.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities involve Denial of Service attacks that can be triggered by specific inputs, leading to application crashes or unresponsiveness.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Simply upload your manifest file, such as package-lock.json, to check for vulnerabilities.
The vulnerabilities are associated with CVE-2026-13149, CVE-2026-59873, and CVE-2026-59874.
Yes, you can limit the input size for requests that utilize the affected functionalities as a temporary workaround.
It is recommended to update to at least version 1:24.18.0-2.module_el8.10.0+4237+cde4efc3 for Node.js and its related packages.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
