Critical Security Update for Node.js 22: Denial of Service Vulnerabilities
Summary
RLSA-2026:75864: Important: nodejs22 security update. Affects nodejs22 versions < 1:22.23.2-3.el10_2. Fixed in 1:22.23.2-3.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified that could compromise the security of applications built on this platform.
Vulnerability Detail
The vulnerabilities identified in Node.js 22 are related to Denial of Service (DoS) attacks. The first vulnerability, tracked as CVE-2026-9496, arises from the 'addGitSha' function in the 'pacote' package, where a crafted 'spec.rawSpec' value can lead to a DoS condition. The second vulnerability, CVE-2026-19534, is found in the 'undici' package, which allows for a DoS via unrequested WebSocket subprotocols. Both vulnerabilities can severely impact the availability of applications, making them susceptible to attacks that could render services inoperable.
How To Fix
Minimum fixed version
1:22.23.2-3.el10_2
This is the first release that contains the fix.
sudo dnf update nodejs22Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the use of the affected packages or implement additional validation on the inputs to the 'addGitSha' function and WebSocket subprotocols to mitigate the risk of exploitation until the package is updated.
Conclusion
In summary, the recent vulnerabilities in Node.js 22 pose significant risks through Denial of Service attacks. It is crucial to update to the latest patched version to safeguard your applications. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for nodejs22 →
FAQ
The vulnerabilities can lead to Denial of Service attacks, making applications unresponsive and potentially causing service outages.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Consider implementing input validation and limiting the use of the affected packages as a temporary workaround until you can perform the update.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
For more details, refer to the CVE pages listed in the references section of the vulnerability report.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs22.
