Critical Security Update for Node.js 24: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:58819: Important: nodejs24 security update. Affects nodejs24 versions < 1:24.18.0-5.el10_2. Fixed in 1:24.18.0-5.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified in Node.js 24, necessitating immediate attention to ensure the security and integrity of applications built on this platform.
Vulnerability Detail
The vulnerabilities identified in Node.js 24 include a Denial of Service (DoS) via memory exhaustion in the brace-expansion package (CVE-2026-14257), Server-Side Request Forgery (SSRF) due to misclassification of IPv4-mapped/NAT64 IPv6 addresses in the ip-address package (CVE-2026-54272), and additional DoS vulnerabilities in brace-expansion (CVE-2026-69152). Furthermore, inconsistent IP address parsing in the ip-address package can lead to SSRF and trust-boundary bypass (CVE-2026-69192). These vulnerabilities can severely impact application performance and security, making it crucial to address them promptly.
How To Fix
Minimum fixed version
1:24.18.0-5.el10_2
This is the first release that contains the fix.
sudo dnf update nodejs24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization to mitigate the risk of SSRF and DoS attacks. Additionally, monitor your application for unusual traffic patterns that may indicate exploitation attempts.
Conclusion
In summary, the recent vulnerabilities in Node.js 24 pose significant risks to applications built on this platform. It is imperative to update to the latest patched version to safeguard against potential attacks. Utilizing tools like Vulert can further enhance your application's security posture by providing real-time vulnerability alerts.
See every vulnerability recorded for nodejs24 →
FAQ
Node.js is a JavaScript runtime built on Chrome's V8 engine, allowing developers to build scalable network applications.
The vulnerabilities can lead to Denial of Service attacks and Server-Side Request Forgery, compromising application security and performance.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by analyzing your manifest file.
Implementing input validation and monitoring for unusual traffic can help mitigate risks until updates are applied.
For detailed information, refer to the CVE pages linked in the advisory or visit the Vulert website for real-time monitoring.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs24.
