Critical Security Update for Node.js: Addressing Unauthorized Access and Memory Exhaustion Vulnerabilities
Summary
ALSA-2026:61376: Important: nodejs22 security update. Affects nodejs versions < 1:22.23.2-1.el10_2. Fixed in 1:22.23.2-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified that could compromise the security and stability of applications built on this platform.
Vulnerability Detail
The vulnerabilities in Node.js arise from flaws in its permission model and HTTP/2 handling. Specifically, CVE-2026-58043 allows unauthorized filesystem access, potentially leading to data breaches. CVE-2026-56846 enables remote memory exhaustion through retained header blocks in HTTP/2, which can degrade performance. Additionally, CVE-2026-56848 presents a heap-use-after-free issue in HTTP/2 handling, which can lead to denial of service attacks, making applications unresponsive.
How To Fix
Minimum fixed version
1:22.23.2-1.el10_2
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to sensitive filesystem paths and monitoring HTTP/2 traffic for unusual patterns. This can help mitigate the risks until the packages are updated.
Conclusion
In summary, the recent vulnerabilities in Node.js pose significant risks to applications built on this platform. It is crucial to update to the latest patched versions of Node.js and its related packages to mitigate these risks. Additionally, utilizing tools like Vulert can enhance your ability to monitor and manage vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The main vulnerabilities include unauthorized filesystem access, remote memory exhaustion, and heap-use-after-free issues in HTTP/2 handling.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
These vulnerabilities can lead to unauthorized access to files, performance degradation, and denial of service, affecting the reliability of applications.
It is recommended to regularly check for updates and apply them promptly to ensure your applications are secure against known vulnerabilities.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
