Critical Denial of Service Vulnerability in Node.js 22 Package
Summary
RLSA-2026:7080: Important: nodejs22 security update. Affects nodejs22 versions < 1:22.22.2-1.el10_1. Fixed in 1:22.22.2-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, vulnerabilities in its libraries can expose applications to severe risks, including Denial of Service (DoS) attacks.
Vulnerability Detail
The vulnerability in Node.js 22 arises from multiple components, including 'brace-expansion', 'minimatch', and 'undici', which can lead to Denial of Service through various means such as unbounded brace range expansion, specially crafted glob patterns, and crafted WebSocket frames. These vulnerabilities can cause applications to crash or become unresponsive, severely impacting service availability. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1:22.22.2-1.el10_1
This is the first release that contains the fix.
sudo dnf update nodejs22Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input size for the affected libraries or implement rate limiting in your application to reduce the risk of Denial of Service attacks. However, these are not permanent solutions and should be followed by an update to the patched version.
Conclusion
In summary, the vulnerabilities in Node.js 22 pose significant risks, particularly in the form of Denial of Service attacks. It is crucial for developers to update their packages to the latest versions to ensure the security and reliability of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs22 →
FAQ
The vulnerability primarily involves Denial of Service attacks that can be triggered through various libraries like 'minimatch' and 'undici'.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You should update your Node.js package to the latest patched version using 'sudo yum update nodejs22' to mitigate the vulnerabilities.
Yes, limiting input sizes and implementing rate limiting can serve as temporary workarounds until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs22.
