Skip to content
OpenAdvisories
High ALSA-2026:47058 3 CVEs

Important: nodejs:22 security update

Published Jul 28, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)
* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 10

ReleasePackageFixed in
AlmaLinux · 9 nodejs 1:22.23.1-2.module_el9.8.0+285+5c3b0251
AlmaLinux · 9 nodejs-devel 1:22.23.1-2.module_el9.8.0+285+5c3b0251
AlmaLinux · 9 nodejs-docs 1:22.23.1-2.module_el9.8.0+285+5c3b0251
AlmaLinux · 9 nodejs-full-i18n 1:22.23.1-2.module_el9.8.0+285+5c3b0251
AlmaLinux · 9 nodejs-libs 1:22.23.1-2.module_el9.8.0+285+5c3b0251
AlmaLinux · 9 nodejs-nodemon 3.1.14-1.module_el9.8.0+285+5c3b0251
AlmaLinux · 9 nodejs-packaging 2021.06-6.module_el9.7.0+227+12323393
AlmaLinux · 9 nodejs-packaging-bundler 2021.06-6.module_el9.7.0+227+12323393
AlmaLinux · 9 npm 1:10.9.8-1.22.23.1.2.module_el9.8.0+285+5c3b0251
AlmaLinux · 9 v8-12.4-devel 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251

Vulnerabilities 3

  • Critical 9.2
    CVE-2026-59873

    node-tar: Decompression/parse DoS via unlimited input

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small …

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-59874

    node-tar: Negative tar entry size causes infinite loop in archive replace

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header.…

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • High 7.7
    CVE-2026-13149

    brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

    brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transit…

    juliangruber brace-expansion langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-13149
  • report
    https://access.redhat.com/security/cve/CVE-2026-59873
  • report
    https://access.redhat.com/security/cve/CVE-2026-59874
  • report
    https://bugzilla.redhat.com/2494813
  • report
    https://bugzilla.redhat.com/2498116
  • report
    https://bugzilla.redhat.com/2498120
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-47058.html