Critical Security Vulnerability in Node.js 24: Authentication Bypass and Denial of Service Risks
Summary
RLSA-2026:73428: Important: nodejs24 security, bug fix, and enhancement update. Affects nodejs24 versions < 1:24.21.0-1.el10_2. Fixed in 1:24.21.0-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified in Node.js 24, particularly affecting the undici library, which is responsible for HTTP/1.1 client functionality.
Vulnerability Detail
The vulnerabilities in Node.js 24 stem from issues in the undici library. These include an authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152), a TLS certificate validation bypass in BalancedPool due to dropped connect options (CVE-2026-84961), and a Denial of Service (DoS) vulnerability via unrequested WebSocket subprotocol (CVE-2026-19534). These vulnerabilities can lead to unauthorized access, potential data breaches, and service disruptions, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
1:24.21.0-1.el10_2
This is the first release that contains the fix.
sudo dnf update nodejs24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional security measures such as restricting access to sensitive endpoints and validating incoming requests more rigorously. However, these measures should not replace the need for updating the package.
Conclusion
In summary, the recent vulnerabilities identified in Node.js 24 pose significant risks to applications utilizing this platform. It is essential for users to update to the latest patched version to safeguard against potential attacks. Implementing additional security measures can provide temporary relief, but updating the package is the most effective solution.
See every vulnerability recorded for nodejs24 →
FAQ
The CVSS score for this vulnerability is 7.5, indicating a high level of severity.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The main risks include unauthorized access to systems, potential data breaches, and service disruptions due to Denial of Service attacks.
Yes, you should upgrade to version 1:24.21.0-1.el10_2 to mitigate the vulnerabilities.
The undici library is an HTTP/1.1 client for Node.js that is crucial for making network requests. Vulnerabilities in this library can significantly impact the security and performance of applications relying on it.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs24.
