Critical Security Update for Node.js 24: Addressing Denial of Service Vulnerabilities
Summary
ALSA-2026:48034: Important: nodejs24 security update. Affects nodejs24 versions < 1:24.18.0-3.el10_2. Fixed in 1:24.18.0-3.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified in Node.js 24, specifically affecting its package ecosystem, which could lead to significant security risks if not addressed promptly.
Vulnerability Detail
The vulnerabilities in Node.js 24 stem from issues in the brace-expansion and tar packages. The brace-expansion vulnerability (CVE-2026-13149) can lead to Denial of Service (DoS) due to exponential-time complexity, while the tar package has two vulnerabilities (CVE-2026-59873 and CVE-2026-59874) that allow for DoS via malformed tar archive headers and crafted gzip bombs, respectively. These vulnerabilities can be exploited by attackers to disrupt service availability, potentially leading to significant downtime and loss of user trust.
How To Fix
Minimum fixed version
1:24.18.0-3.el10_2
This is the first release that contains the fix.
sudo dnf update nodejs24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the exposure of your application to untrusted inputs that could exploit these vulnerabilities. Additionally, consider implementing rate limiting on your application to mitigate the impact of potential DoS attacks.
Conclusion
The identified vulnerabilities in Node.js 24 pose significant risks, particularly in terms of Denial of Service attacks. It is crucial for users to update their packages to the latest patched versions to maintain security and service availability. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for nodejs24 →
FAQ
The vulnerabilities are related to Denial of Service attacks caused by issues in the brace-expansion and tar packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Failure to address these vulnerabilities could lead to service disruptions, downtime, and loss of user trust due to Denial of Service attacks.
Yes, you should update to version 1:24.18.0-3.el10_2 to ensure that the vulnerabilities are patched.
Implement rate limiting and restrict untrusted inputs to mitigate the risk of exploitation until you can update.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs24.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
