Critical Denial of Service Vulnerability in Node.js 24 Package
Summary
RLSA-2026:48034: Important: nodejs24 security update. Affects nodejs24 versions < 1:24.18.0-3.el10_2. Fixed in 1:24.18.0-3.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It utilizes an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, vulnerabilities in its libraries can expose applications to significant risks.
Vulnerability Detail
The vulnerability stems from multiple issues within the Node.js 24 package, specifically related to the brace-expansion and tar libraries. The brace-expansion vulnerability (CVE-2026-13149) can lead to a Denial of Service (DoS) due to exponential-time complexity, while the tar library vulnerabilities (CVE-2026-59873 and CVE-2026-59874) can also cause DoS through malformed tar archive headers and crafted gzip bombs. These vulnerabilities can severely impact application availability, making it crucial for users to address them promptly.
How To Fix
Minimum fixed version
1:24.18.0-3.el10_2
This is the first release that contains the fix.
sudo dnf update nodejs24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the input size or validate the input data before processing it with the affected libraries. This can help reduce the risk of triggering the vulnerabilities until the package is updated.
Conclusion
In summary, the Node.js 24 package has critical vulnerabilities that can lead to Denial of Service attacks. It is essential for users to update to the patched version to secure their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs24 →
FAQ
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
The vulnerabilities can lead to Denial of Service attacks, making applications unavailable to users and potentially causing significant downtime.
Yes, implementing input validation and limiting input sizes can help mitigate the risk of exploitation until the package is updated.
For more details, you can refer to the CVE pages associated with the vulnerabilities: CVE-2026-13149, CVE-2026-59873, and CVE-2026-59874.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs24.
