Critical Security Update for Node.js 24: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:1842: Important: nodejs24 security update. Affects nodejs24 versions < 1:24.13.0-1.el10_1. Fixed in 1:24.13.0-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified in Node.js 24, necessitating immediate attention to ensure the security and integrity of applications built on this platform.
Vulnerability Detail
The vulnerabilities in Node.js 24 include a filesystem permissions bypass (CVE-2025-55130), denial of service issues (CVE-2025-59465, CVE-2025-59466, CVE-2026-21637), and uninitialized memory exposure (CVE-2025-55131). These vulnerabilities can lead to unauthorized access, service disruptions, and potential data leaks, posing significant risks to applications relying on this version of Node.js.
How To Fix
Minimum fixed version
1:24.13.0-1.el10_1
This is the first release that contains the fix.
sudo dnf update nodejs24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the affected Node.js applications and monitoring them closely for any unusual activity until the update can be applied. Implementing rate limiting and input validation can also help mitigate some of the denial of service vulnerabilities.
Conclusion
The identified vulnerabilities in Node.js 24 pose significant risks to applications built on this platform. It is crucial to update to the latest patched version to mitigate these risks and ensure the security of your applications. Utilize tools like Vulert to stay informed about potential vulnerabilities in your software.
See every vulnerability recorded for nodejs24 →
FAQ
The main vulnerabilities include filesystem permissions bypass, denial of service attacks, and uninitialized memory exposure.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, implement temporary workarounds such as restricting access and monitoring for unusual activity.
These vulnerabilities can lead to unauthorized access, service disruptions, and data leaks, which can compromise the security of your applications.
For more details, refer to the CVE pages listed in the vulnerability advisory or consult the official Node.js documentation.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs24.
