Critical Security Update for Node.js 24: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:61377: Important: nodejs24 security, bug fix, and enhancement update. Affects nodejs24 versions < 1:24.19.0-1.el10_2. Fixed in 1:24.19.0-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified that could compromise the security and stability of applications built on this platform.
Vulnerability Detail
The vulnerabilities in Node.js 24 include unauthorized filesystem access due to a flaw in the permission model (CVE-2026-58043), remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846), and a heap-use-after-free issue in HTTP/2 handling that can lead to denial of service (CVE-2026-56848). These vulnerabilities could allow attackers to exploit the system, leading to unauthorized access, service disruption, or resource exhaustion.
How To Fix
Minimum fixed version
1:24.19.0-1.el10_2
This is the first release that contains the fix.
sudo dnf update nodejs24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While waiting for the update, consider restricting access to the affected services and monitoring for unusual activity. Implementing additional security measures, such as firewalls and intrusion detection systems, can also help mitigate potential risks.
Conclusion
In summary, Node.js 24 has critical vulnerabilities that require immediate attention. Updating to the latest patched version is crucial to ensure the security and stability of applications built on this platform. Utilize tools like Vulert to monitor for vulnerabilities and stay informed.
See every vulnerability recorded for nodejs24 →
FAQ
The main vulnerabilities include unauthorized filesystem access, remote memory exhaustion, and heap-use-after-free issues in HTTP/2 handling.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
These vulnerabilities can lead to unauthorized access, denial of service, and resource exhaustion, potentially compromising the security and stability of applications.
If immediate updates are not possible, implement security measures like restricting access and monitoring for unusual activity to mitigate risks.
For detailed information, refer to the CVE pages listed in the advisory or the official Node.js documentation.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs24.
