Skip to content
OpenAdvisories
High ALAS2023-2026-2059 23 CVEs

Important: nodejs24 security update (Amazon Linux 2023)

Published Aug 17, 2026 · Updated Aug 21, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains CVE-2026-59875: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17. CVE-2026-59874: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18. CVE-2026-59873: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19. CVE-2026-59871: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18. CVE-2026-58045: NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodezlib-sync-apis-can-crash-on-spoofed-typedarray-length-cve-2026-58045---medium CVE-2026-58044: NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http-parser-header-truncation-can-enable-request-smuggling-cve-2026-58044---low CVE-2026-58043: A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**. CVE-2026-58042: A flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS response contains more than 256 A records. Repeated triggering of this condition can lead to denial of service. CVE-2026-58041: NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodesqlite-sqltagstore-iterator-replay-can-re-execute-writes-cve-2026-58041---medium CVE-2026-58040: An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. CVE-2026-58039: A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. CVE-2026-56850: A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. CVE-2026-56848: A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. CVE-2026-56847: A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits CVE-2026-53655: node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16. CVE-2026-16729: undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs24 1:24.18.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-debuginfo 1:24.18.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-debugsource 1:24.18.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-devel 1:24.18.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-docs 1:24.18.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-full-i18n 1:24.18.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-libs 1:24.18.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-libs-debuginfo 1:24.18.1-1.amzn2023.0.2
Amazon Linux · 2023 nodejs24-npm 1:11.16.0-1.24.18.1.1.amzn2023.0.2
Amazon Linux · 2023 v8-13.6-devel 3:13.6.233.17-1.24.18.1.1.amzn2023.0.2

Vulnerabilities 23

  • Critical 9.2
    CVE-2026-59873

    node-tar: Decompression/parse DoS via unlimited input

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small …

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-59874

    node-tar: Negative tar entry size causes infinite loop in archive replace

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header.…

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • High 7.7
    CVE-2026-13149

    brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

    brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transit…

    juliangruber brace-expansion langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  • High 7.5
    CVE-2026-56846 Public exploit

    A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memo…

    Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  • High 7.5
    CVE-2026-56848 Public exploit

    A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_…

    Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  • High 7.5
    CVE-2026-58043 Public exploit

    A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-69184

    c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains

    c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long desc…

    c-ares c-ares fluent-bit c-ares Debian Ubuntu Azure Linux
  • High 7.4
    CVE-2026-13697

    undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

    undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be sto…

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 6.9
    CVE-2026-53655

    node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

    node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or lo…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • Medium 6.3
    CVE-2026-58040 Public exploit

    An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.2
    CVE-2026-58045 Public exploit

    A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:…

    Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  • Medium 5.9
    CVE-2026-14643

    undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

    undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directi…

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 5.9
    CVE-2026-58042 Public exploit

    A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Re…

    Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  • Medium 5.3
    CVE-2026-58041 Public exploit

    A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to con…

    Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  • Medium 5.3
    CVE-2026-59871

    node-tar: Process crash via PAX numeric path type confusion

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to t…

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • Medium 5.3
    CVE-2026-59875

    node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with…

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • Medium 4.8
    CVE-2026-16728

    undici vulnerable to downstream response desynchronization via retry interceptor

    undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up t…

    undici undici langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Medium 4.8
    CVE-2026-16729

    undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

    undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized…

    undici undici langfuse-3-worker renovate Debian Ubuntu Azure Linux Wolfi npm
  • Medium 4.2
    CVE-2026-15157

    undici vulnerable to CRLF Injection via blob-like body 'type' property

    undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application…

    undici undici langfuse-3-worker renovate Debian Ubuntu Azure Linux Wolfi npm
  • Medium 4.1
    CVE-2026-56850 Public exploit

    A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.7
    CVE-2026-58044 Public exploit

    A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…

    Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  • Low 3.3
    CVE-2026-56847 Public exploit

    A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.3
    CVE-2026-58039 Public exploit

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-13149.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-13697.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14643.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-15157.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-16728.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-16729.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-53655.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56846.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56847.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56848.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56850.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58039.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58040.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58041.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58042.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58043.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58044.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58045.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-59871.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-59873.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-59874.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-59875.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-69184.html