Skip to content
OpenAdvisories
High ALSA-2026:48033 3 CVEs

Important: nodejs22 security update

Published Jul 29, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)
* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 6

ReleasePackageFixed in
AlmaLinux · 10 nodejs 1:22.23.1-4.el10_2
AlmaLinux · 10 nodejs-devel 1:22.23.1-4.el10_2
AlmaLinux · 10 nodejs-docs 1:22.23.1-4.el10_2
AlmaLinux · 10 nodejs-full-i18n 1:22.23.1-4.el10_2
AlmaLinux · 10 nodejs-libs 1:22.23.1-4.el10_2
AlmaLinux · 10 nodejs-npm 1:10.9.8-1.22.23.1.4.el10_2

Vulnerabilities 3

  • Critical 9.2
    CVE-2026-59873

    node-tar: Decompression/parse DoS via unlimited input

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small …

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • High 8.7
    CVE-2026-59874

    node-tar: Negative tar entry size causes infinite loop in archive replace

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header.…

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • High 7.7
    CVE-2026-13149

    brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

    brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transit…

    juliangruber brace-expansion langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-13149
  • report
    https://access.redhat.com/security/cve/CVE-2026-59873
  • report
    https://access.redhat.com/security/cve/CVE-2026-59874
  • report
    https://bugzilla.redhat.com/2494813
  • report
    https://bugzilla.redhat.com/2498116
  • report
    https://bugzilla.redhat.com/2498120
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-48033.html