Critical Security Flaws in Node.js 24: Authentication Bypass and Denial of Service Vulnerabilities
Summary
ALSA-2026:73428: Important: nodejs24 security, bug fix, and enhancement update. Affects nodejs24 versions < 1:24.21.0-1.el10_2. Fixed in 1:24.21.0-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified in Node.js 24 that could compromise application security.
Vulnerability Detail
The vulnerabilities in Node.js 24 stem from issues within the 'undici' library. Specifically, there are three critical security flaws: an authentication bypass due to missing origin isolation (CVE-2026-85152), a TLS certificate validation bypass in BalancedPool (CVE-2026-84961), and a denial of service vulnerability via unrequested WebSocket subprotocol (CVE-2026-19534). These vulnerabilities could allow unauthorized access, data breaches, or service disruptions, posing significant risks to applications relying on Node.js 24.
How To Fix
Minimum fixed version
1:24.21.0-1.el10_2
This is the first release that contains the fix.
sudo dnf update nodejs24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as validating incoming requests and enforcing strict origin policies until the update can be applied. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The vulnerabilities identified in Node.js 24 pose significant risks to applications utilizing this platform. It is essential to update to the patched version to mitigate these risks effectively. Implementing temporary workarounds can provide some level of protection, but the priority should be on applying the updates as soon as possible.
See every vulnerability recorded for nodejs24 →
FAQ
Node.js is a JavaScript runtime built on Chrome's V8 engine, designed for building scalable network applications.
The main vulnerabilities include authentication bypass, TLS certificate validation bypass, and denial of service issues.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, implement security measures such as validating requests and enforcing strict origin policies as a temporary workaround.
For detailed information, refer to the CVE pages listed in the vulnerability report, which provide insights into the impact and technical details.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs24.
