Critical Security Update for Node.js Packages: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:75864: Important: nodejs22 security update. Affects nodejs versions < 1:22.23.2-3.el10_2. Fixed in 1:22.23.2-3.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified that could compromise the security of applications built on this platform.
Vulnerability Detail
The vulnerabilities identified in Node.js relate to Denial of Service (DoS) attacks. The first vulnerability, tracked as CVE-2026-9496, arises from the 'pacote' package, where a crafted 'spec.rawSpec' value in the 'addGitSha' function can lead to a DoS condition. The second vulnerability, CVE-2026-19534, is associated with the 'undici' package, which allows for a DoS via unrequested WebSocket subprotocols. These vulnerabilities can severely affect the availability of applications, leading to potential service interruptions.
How To Fix
Minimum fixed version
1:22.23.2-3.el10_2
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing rate limiting on your application to mitigate the impact of potential DoS attacks. Additionally, review and sanitize inputs to the 'addGitSha' function to prevent crafted inputs from being processed.
Conclusion
In summary, the identified vulnerabilities in Node.js pose significant risks to applications built on this platform. It is crucial to apply the recommended updates to mitigate these risks effectively. Utilizing tools like Vulert can further enhance your security posture by providing real-time alerts for open-source vulnerabilities.
See every vulnerability recorded for nodejs →
FAQ
A Denial of Service attack aims to make a service unavailable to its intended users by overwhelming it with traffic or exploiting vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Failure to address these vulnerabilities can lead to service outages, loss of user trust, and potential financial repercussions due to downtime.
Yes, applying the updates will fix the identified vulnerabilities, making your Node.js applications safer.
More details can be found on the CVE pages for CVE-2026-19534 and CVE-2026-9496, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
