Critical Security Flaw in Node.js 24: Denial of Service and Information Disclosure Vulnerabilities
Summary
RLSA-2026:7675: Important: nodejs24 security update. Affects nodejs24 versions < 1:24.14.1-2.el10_1. Fixed in 1:24.14.1-2.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast, scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have exposed Node.js 24 to significant security risks, necessitating immediate attention from users and developers.
Vulnerability Detail
The vulnerabilities in Node.js 24 include multiple denial of service (DoS) issues, HTTP header injection, and information disclosure risks. These vulnerabilities arise from flaws in various components, including undici and nghttp2, which can lead to uncontrolled resource consumption, crafted HTTP requests causing service interruptions, and unauthorized access to sensitive information. The CVSS score for these vulnerabilities is 7.5, indicating a high severity level that could severely impact application availability and data integrity.
How To Fix
Minimum fixed version
1:24.14.1-2.el10_1
This is the first release that contains the fix.
sudo dnf update nodejs24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their Node.js applications by implementing rate limiting and input validation to mitigate the risk of denial of service attacks. Additionally, consider using a reverse proxy to filter and manage incoming traffic.
Conclusion
The vulnerabilities in Node.js 24 pose significant risks to application security and performance. It is crucial for users to update to the latest patched version and consider implementing additional security measures to protect their applications from potential attacks.
See every vulnerability recorded for nodejs24 →
FAQ
The vulnerabilities include denial of service attacks, HTTP header injection, and information disclosure, which can compromise application security and availability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
The CVSS score of the vulnerabilities is 7.5, indicating a high severity level that requires immediate attention.
Update your Node.js package to the patched version 1:24.14.1-2.el10_1 using 'sudo yum update nodejs24' to mitigate the vulnerabilities.
Yes, implementing rate limiting and input validation can help mitigate the risk of denial of service attacks while you prepare to update your package.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs24.
