Critical Security Update for Node.js: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:48033: Important: nodejs22 security update. Affects nodejs versions < 1:22.23.1-4.el10_2. Fixed in 1:22.23.1-4.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified that could potentially compromise the integrity and availability of applications built on this platform.
Vulnerability Detail
The vulnerabilities identified in Node.js include a Denial of Service (DoS) attack due to exponential-time complexity in the brace-expansion module (CVE-2026-13149), and two issues in the tar module: one involving a malformed tar archive header (CVE-2026-59874) and another related to a crafted gzip bomb (CVE-2026-59873). These vulnerabilities can lead to significant service disruptions, making it crucial for users to address them promptly.
How To Fix
Minimum fixed version
1:22.23.1-4.el10_2
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the input size for the brace-expansion and tar modules to mitigate the risk of DoS attacks. This can be done by implementing input validation checks in the application code to ensure that excessively large inputs are rejected.
Conclusion
In summary, the recent vulnerabilities in Node.js pose significant risks that can lead to Denial of Service attacks. It is essential for users to update their packages to the latest patched versions to ensure the security and reliability of their applications. Implementing workarounds can provide temporary relief, but timely updates are the best defense against these vulnerabilities.
See every vulnerability recorded for nodejs →
FAQ
A Denial of Service (DoS) vulnerability allows an attacker to disrupt the normal functioning of a service, making it unavailable to legitimate users.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without needing to sign up.
Failure to address these vulnerabilities can lead to service outages, loss of data, and potential exploitation by malicious actors, impacting user trust and business operations.
Yes, you can use package managers like npm or dnf to automate the update process. Regularly scheduled updates can help ensure that your packages remain secure.
If immediate updates are not possible, implement input validation and limit the size of inputs to reduce the risk of exploitation until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
