Critical Security Update for Node.js Packages: Addressing Denial of Service and SSRF Vulnerabilities
Summary
ALSA-2026:55541: Important: nodejs22 security update. Affects nodejs versions < 1:22.23.1-6.el10_2. Fixed in 1:22.23.1-6.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient, particularly for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified that could compromise the security of applications built on this platform.
Vulnerability Detail
The vulnerabilities identified in Node.js packages include a Denial of Service (DoS) risk due to memory exhaustion in the brace-expansion module (CVE-2026-14257), another DoS risk from unbounded intermediate arrays in the same module (CVE-2026-69152), and a Server-Side Request Forgery (SSRF) vulnerability caused by inconsistent IP address parsing in the ip-address module (CVE-2026-69192). These vulnerabilities can lead to severe disruptions in service and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1:22.23.1-6.el10_2
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing rate limiting on your application to mitigate the risk of Denial of Service attacks. Additionally, validate and sanitize all user inputs to prevent SSRF attacks.
Conclusion
In summary, the recent vulnerabilities in Node.js packages pose significant risks that can lead to Denial of Service and unauthorized access. It is crucial to update affected packages promptly to ensure the security of your applications. Utilize tools like Vulert to monitor your software for vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities include Denial of Service risks and Server-Side Request Forgery, which can lead to service disruptions and unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Implement rate limiting and input validation as temporary measures to reduce the risk of exploitation until you can apply the updates.
Versions 1:22.23.1-6.el10_2 and above have the necessary security patches to address these vulnerabilities.
Detailed information can be found on the CVE pages linked in the advisory, or by visiting the official Node.js security documentation.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
