Skip to content
OpenAdvisories
Medium ALAS2023-2026-2141 1 CVE

Moderate: nodejs24 security update (Amazon Linux 2023)

Published Sep 14, 2026 · Updated Sep 14, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-9496: Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function's regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 nodejs24 1:24.20.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-debuginfo 1:24.20.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-debugsource 1:24.20.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-devel 1:24.20.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-docs 1:24.20.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-full-i18n 1:24.20.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-libs 1:24.20.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-libs-debuginfo 1:24.20.0-1.amzn2023.0.1
Amazon Linux · 2023 nodejs24-npm 1:11.19.0-1.24.20.0.1.amzn2023.0.1
Amazon Linux · 2023 v8-13.6-devel 3:13.6.233.17-1.24.20.0.1.amzn2023.0.1

Vulnerabilities 1

  • High 7.5
    CVE-2026-9496

    pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

    Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s rege…

    prism lerna npm npm Debian Ubuntu Wolfi npm

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-9496.html