Critical Security Update for Node.js: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:1843: Important: nodejs22 security update. Affects nodejs versions < 1:22.22.0-3.el10_1. Fixed in 1:22.22.0-3.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified that could compromise the security and stability of applications built on this platform.
Vulnerability Detail
The vulnerabilities in Node.js include a filesystem permissions bypass (CVE-2025-55130), multiple denial of service issues (CVE-2025-59465, CVE-2025-59466, CVE-2026-21637), and uninitialized memory exposure (CVE-2025-55131). These vulnerabilities can lead to unauthorized access, service disruption, and potential data leaks, posing significant risks to applications relying on Node.js.
How To Fix
Minimum fixed version
1:22.22.0-3.el10_1
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to sensitive files and monitoring application logs for unusual activity until the update can be applied. Additionally, implement rate limiting to mitigate denial of service attacks.
Conclusion
In summary, the recent vulnerabilities in Node.js pose significant risks to applications built on this platform. It is crucial to update to the latest patched versions to ensure security and stability. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your software effectively.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities include filesystem permissions bypass, denial of service, and uninitialized memory exposure, which can lead to unauthorized access and service disruptions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The vulnerabilities can lead to unauthorized access, data leaks, and service disruptions, affecting the overall security and performance of applications.
While updating is the best solution, you can implement temporary workarounds such as restricting file access and monitoring logs for unusual activity.
For detailed information, refer to the CVE pages listed in the vulnerability report or visit the official Node.js documentation.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
