Critical Security Vulnerability in Node.js 24: Denial of Service and Server-Side Request Forgery Risks
Summary
RLSA-2026:58819: Important: nodejs24 security update. Affects nodejs24 versions < 1:24.18.0-5.el10_2. Fixed in 1:24.18.0-5.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications across distributed devices. However, recent vulnerabilities have been identified that could compromise the security of applications built on this platform.
Vulnerability Detail
The vulnerabilities in Node.js 24 stem from issues in the brace-expansion and ip-address packages. Specifically, CVE-2026-14257 and CVE-2026-69152 expose applications to Denial of Service (DoS) attacks through memory exhaustion and unbounded intermediate arrays. Additionally, CVE-2026-54272 and CVE-2026-69192 allow for Server-Side Request Forgery (SSRF) due to misclassification of IPv4-mapped/NAT64 IPv6 addresses and inconsistent IP address parsing, respectively. These vulnerabilities can lead to unauthorized access and manipulation of sensitive data.
How To Fix
Minimum fixed version
1:24.18.0-5.el10_2
This is the first release that contains the fix.
sudo dnf update nodejs24Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing input validation and sanitization to mitigate the risk of SSRF and DoS attacks. Additionally, monitor your application for unusual traffic patterns that may indicate exploitation attempts.
Conclusion
The vulnerabilities identified in Node.js 24 pose significant risks, including Denial of Service and Server-Side Request Forgery. It is crucial for developers to update their packages to the latest patched version to mitigate these risks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for nodejs24 →
FAQ
The CVSS score for this vulnerability is 8.6, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of these vulnerabilities can lead to Denial of Service, unauthorized access to sensitive data, and potential manipulation of application behavior.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, implement input validation and monitor your application for unusual behavior as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs24.
