Critical Security Update for Node.js: Addressing Vulnerabilities in Version 22
Summary
RHSA-2026:75870: Red Hat Security Advisory: nodejs:22 security update. Affects nodejs versions < 1:22.23.2-2.module+el8.10.0+24957+74108fbf. Fixed in 1:22.23.2-2.module+el8.10.0+24957+74108fbf. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine, enabling developers to build scalable network applications. It is widely used for server-side development due to its non-blocking, event-driven architecture. The recent security advisory highlights vulnerabilities that could potentially compromise the integrity and availability of applications relying on Node.js version 22.
Vulnerability Detail
The vulnerabilities identified in Node.js (CVE-2026-19534 and CVE-2026-9496) stem from flaws in the handling of certain inputs and operations, which could allow an attacker to execute arbitrary code or cause a denial of service. These vulnerabilities can lead to severe ramifications, including unauthorized access to sensitive data and disruption of service, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
1:22.23.2-2.module+el8.10.0+24957+74108fbf
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their Node.js applications by implementing strict input validation and sanitization to prevent malicious data from being processed. Additionally, consider using a firewall to restrict access to the application until the update is applied.
Conclusion
In summary, the recent security advisory for Node.js highlights critical vulnerabilities that require immediate attention. By updating to the latest patched version, users can protect their applications from potential threats. Implementing workarounds can provide temporary relief, but timely updates are essential for long-term security.
See every vulnerability recorded for nodejs →
FAQ
The vulnerabilities are associated with CVE-2026-19534 and CVE-2026-9496.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement strict input validation and use a firewall to limit access to your application.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:75870.json.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
