Skip to content
OpenAdvisories
High ALAS2023-2026-2060 19 CVEs

Important: nodejs22 security update (Amazon Linux 2023)

Published Aug 17, 2026 · Updated Aug 17, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-9496: Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function's regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process. CVE-2026-69184: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains CVE-2026-59874: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18. CVE-2026-59873: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19. CVE-2026-58045: NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodezlib-sync-apis-can-crash-on-spoofed-typedarray-length-cve-2026-58045---medium CVE-2026-58044: NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http-parser-header-truncation-can-enable-request-smuggling-cve-2026-58044---low CVE-2026-58043: A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**. CVE-2026-58042: A flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS response contains more than 256 A records. Repeated triggering of this condition can lead to denial of service. CVE-2026-58040: An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. CVE-2026-58039: A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. CVE-2026-56850: A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. CVE-2026-56848: A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. CVE-2026-56847: A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits CVE-2026-50812: A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer. CVE-2026-16729: undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0. CVE-2026-16728: undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0. CVE-2026-15157: undici does not validate the type property of a duck-typed

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs22 1:22.23.2-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-debuginfo 1:22.23.2-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-debugsource 1:22.23.2-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-devel 1:22.23.2-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-docs 1:22.23.2-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-full-i18n 1:22.23.2-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-libs 1:22.23.2-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-libs-debuginfo 1:22.23.2-1.amzn2023.0.2
Amazon Linux · 2023 nodejs22-npm 1:10.9.8-1.22.23.2.1.amzn2023.0.2
Amazon Linux · 2023 v8-12.4-devel 3:12.4.254.21-1.22.23.2.1.amzn2023.0.2

Vulnerabilities 19

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-13149.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-15157.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-16728.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-16729.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50812.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56846.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56847.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56848.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-56850.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58039.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58040.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58042.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58043.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58044.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-58045.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-59873.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-59874.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-69184.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-9496.html