Description
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL.
The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL.
An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potentially leading to process termination, depending on the system configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NodeJS | Node | 4.0 – < 4.*, 5.0 – < 5.*, 6.0 – < 6.*, 7.0 – < 7.*, 8.0 – < 8.*, 9.0 – < 9.*, 10.0 – < 10.*, 11.0 – < 11.*, 12.0 – < 12.*, 13.0 – < 13.*, 14.0 – < 14.*, 15.0 – < 15.*, 16.0 – < 16.*, 17.0 – < 17.*, 18.0 – < 18.19.1, 19.0 – < 19.*, 20.0 – < 20.11.1, 21.0 – < 21.6.2 | 4.* |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nodejs | 18.19.1+dfsg-1 | — |
| Debian 13 | nodejs | 18.19.1+dfsg-1 | — |
| Debian 12 | nodejs | 18.20.4+dfsg-1~deb12u1 | DSA-5991-1 |
| Debian 11 | nodejs | 12.22.12~dfsg-1~deb11u5 | DLA-3886-1 |
| Debian 10 | nodejs | 10.24.0~dfsg-1~deb10u4 | DLA-3776-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 20.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 18.04 LTS | nodejs | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 14.04 LTS | nodejs | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | nodejs +3 | 1:16.20.2-8.el9_4 | RHSA-2024:2910, RHSA-2024:2853, RHSA-2024:2779 |
| RHEL 9 | nodejs-devel | 1:18.20.2-2.module+el9.4.0+21742+692df1ea | RHSA-2024:2853, RHSA-2024:2779 |
| RHEL 9 | nodejs-nodemon | 3.0.1-1.module+el9.3.0.z+20478+84a9f781 | RHSA-2024:2853, RHSA-2024:2779 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-4.module+el9.1.0+15718+e52ec601 | RHSA-2024:2853, RHSA-2024:2779 |
| RHEL 9 | npm | 1:8.19.4-1.16.20.2.8.el9_4 | RHSA-2024:2910, RHSA-2024:2853, RHSA-2024:2779 |
| RHEL 8 | nodejs +3 | 1:18.20.2-1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780, RHSA-2024:2778 |
| RHEL 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+20473+c4e3d824 | RHSA-2024:2780, RHSA-2024:2778 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-4.module+el8.9.0+19519+e25b965a | RHSA-2024:2780, RHSA-2024:2778 |
| RHEL 8 | npm | 1:10.5.0-1.18.20.2.1.module+el8.9.0+21767+537f34ee | RHSA-2024:2780, RHSA-2024:2778 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | nodejs +3 | 1:16.20.2-6.el9_2.3 | RHSA-2024:4559 |
| RHEL 9.2 EUS | npm | 1:8.19.4-1.16.20.2.6.el9_2.3 | RHSA-2024:4559 |
| RHEL 9.0 E4S | nodejs +3 | 1:16.20.2-9.el9_0 | RHSA-2024:4721 |
| RHEL 9.0 E4S | npm | 1:8.19.4-1.16.20.2.9.el9_0 | RHSA-2024:4721 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | nodejs +3 | 1:16.20.2-8.el9_4 | ALSA-2024:2910, ALSA-2024:2853, ALSA-2024:2779 |
| AlmaLinux 9 | nodejs-devel | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2853, ALSA-2024:2779 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.2.0+36+853e48f5 | ALSA-2024:2853, ALSA-2024:2779 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2024:2853, ALSA-2024:2779 |
| AlmaLinux 9 | npm | 1:8.19.4-1.16.20.2.8.el9_4 | ALSA-2024:2910, ALSA-2024:2853, ALSA-2024:2779 |
| AlmaLinux 8 | nodejs +3 | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780, ALSA-2024:2778 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2024:2780, ALSA-2024:2778 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780, ALSA-2024:2778 |
| AlmaLinux 8 | npm | 1:10.5.0-1.18.20.2.1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780, ALSA-2024:2778 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | nodejs | 1:16.20.2-8.el9_4 | RLSA-2024:2910 |
| Rocky Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:2853, RLSA-2024:2779 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:2853, RLSA-2024:2779 |
| Rocky Linux 8 | nodejs | 1:18.20.2-1.module+el8.9.0+1803+9ac8b495 | RLSA-2024:2780, RLSA-2024:2778 |
| Rocky Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:2780, RLSA-2024:2778 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:2780, RLSA-2024:2778 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:0730-1 |
| SLES 15 SP5 | nodejs20 | 20.11.1-150500.11.6.1 | SUSE-SU-2024:0643-1 |
| SLES 15 SP4 | nodejs16 | 16.20.2-150400.3.30.1 | SUSE-SU-2024:0728-1 |
| SLES 15 SP4 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:0730-1 |
| SLES 15 SP3 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SLES 15 SP3 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SLES 15 SP3 | nodejs16 | 16.20.2-150300.7.33.1 | SUSE-SU-2024:0729-1 |
| SLES 15 SP2 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SLES 15 SP2 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SLES 12 | nodejs16 | 16.20.2-8.39.1 | SUSE-SU-2024:0731-1 |
| SLES 12 | nodejs18 | 18.19.1-8.18.1 | SUSE-SU-2024:0644-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | nodejs16 | 16.20.2-150400.3.30.1 | SUSE-SU-2024:0728-1 |
| SLES for SAP 15 SP4 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:0730-1 |
| SLES for SAP 15 SP3 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SLES for SAP 15 SP3 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SLES for SAP 15 SP3 | nodejs16 | 16.20.2-150300.7.33.1 | SUSE-SU-2024:0729-1 |
| SLES for SAP 15 SP2 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SLES for SAP 15 SP2 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SLE HPC 15 SP4 | nodejs16 | 16.20.2-150400.3.30.1 | SUSE-SU-2024:0728-1 |
| SLE HPC 15 SP4 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:0730-1 |
| SLE HPC 15 SP3 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SLE HPC 15 SP3 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SLE HPC 15 SP3 | nodejs16 | 16.20.2-150300.7.33.1 | SUSE-SU-2024:0729-1 |
| SLE HPC 15 SP2 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SLE HPC 15 SP2 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SUSE Manager Server 4.3 | nodejs16 | 16.20.2-150400.3.30.1 | SUSE-SU-2024:0728-1 |
| SUSE Manager Server 4.3 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:0730-1 |
| SUSE Enterprise Storage 7.1 | nodejs12 | 12.22.12-150200.4.56.1 | SUSE-SU-2024:0733-1 |
| SUSE Enterprise Storage 7.1 | nodejs14 | 14.21.3-150200.15.55.1 | SUSE-SU-2024:0732-1 |
| SUSE Enterprise Storage 7.1 | nodejs16 | 16.20.2-150300.7.33.1 | SUSE-SU-2024:0729-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nodejs20 | 20.11.1-1.1 | openSUSE-SU-2024:13697-1 |
| openSUSE Tumbleweed | nodejs21 | 21.6.2-1.1 | openSUSE-SU-2024:13698-1 |
| openSUSE Leap 15.5 | nodejs18 | 18.19.1-150400.9.18.2 | SUSE-SU-2024:0730-1 |
| openSUSE Leap 15.5 | nodejs20 | 20.11.1-150500.11.6.1 | SUSE-SU-2024:0643-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs +4 | 1:18.18.2-1.amzn2023.0.3 | ALAS2023-2024-568 |
| Amazon Linux 2023 | nodejs-npm | 1:9.8.1-1.18.18.2.1.amzn2023.0.3 | ALAS2023-2024-568 |
| Amazon Linux 2023 | nodejs20 +4 | 1:20.11.1-1.amzn2023.0.1 | ALAS2023-2024-544 |
| Amazon Linux 2023 | nodejs20-npm | 1:10.2.4-1.20.11.1.1.amzn2023.0.1 | ALAS2023-2024-544 |
| Amazon Linux 2023 | v8-10.2-devel | 3:10.2.154.26-1.18.18.2.1.amzn2023.0.3 | ALAS2023-2024-568 |
| Amazon Linux 2023 | v8-11.3-devel | 3:11.3.244.8-1.20.11.1.1.amzn2023.0.1 | ALAS2023-2024-544 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | nodejs | 20.14.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | nodejs | 16.20.2-4 | — |
| Azure Linux 2 (CBL-Mariner) | nodejs18 | 18.18.2-5 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | nodejs +3 | 1:16.20.2-8.0.1.el9_4 | ELSA-2024-2910, ELSA-2024-2853, ELSA-2024-2779 |
| Oracle Linux 9 | nodejs-devel | 1:18.20.2-1.module+el9.4.0+90321+c72a88c5 | ELSA-2024-2853, ELSA-2024-2779 |
| Oracle Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.3.0+90066+12d4a8d7 | ELSA-2024-2853, ELSA-2024-2779 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-4.module+el9.1.0+20762+f52d7401 | ELSA-2024-2853, ELSA-2024-2779 |
| Oracle Linux 9 | npm | 1:8.19.4-1.16.20.2.8.0.1.el9_4 | ELSA-2024-2910, ELSA-2024-2853, ELSA-2024-2779 |
| Oracle Linux 8 | nodejs +3 | 1:18.20.2-1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780, ELSA-2024-2778 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+90082+b6a613a6 | ELSA-2024-2780, ELSA-2024-2778 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-4.module+el8.9.0+90082+b6a613a6 | ELSA-2024-2780, ELSA-2024-2778 |
| Oracle Linux 8 | npm | 1:10.5.0-1.18.20.2.1.module+el8.9.0+90319+0b1e7189 | ELSA-2024-2780, ELSA-2024-2778 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | nodejs-16 | No fix yet | — |
Advisories 41
- ALSA-2024:2910 Important: nodejs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2779 Important: nodejs:18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2853 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2778 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2780 Important: nodejs:18 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:4721 Red Hat Security Advisory: nodejs security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:2853 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:2910 Red Hat Security Advisory: nodejs security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:2779 Red Hat Security Advisory: nodejs:18 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:2780 Red Hat Security Advisory: nodejs:18 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:2778 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2024-0393 Node.js: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 28, 2026
- RHSA-2024:4559 Red Hat Security Advisory: nodejs security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- DSA-5991-1 nodejs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3886-1 nodejs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3776-1 nodejs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2024:2778 Important: nodejs:20 security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2024:2780 Important: nodejs:18 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2024:0730-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0643-1 Security update for nodejs20 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0733-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0728-1 Security update for nodejs16 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13698-1 corepack21-21.6.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0729-1 Security update for nodejs16 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0644-1 Security update for nodejs18 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0732-1 Security update for nodejs14 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13697-1 corepack20-20.11.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:0731-1 Security update for nodejs16 SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2024:2910 Important: nodejs security update Rocky Linux Security Advisories · Oct 9, 2025
- RLSA-2024:2779 Important: nodejs:18 security update Rocky Linux Security Advisories · Oct 9, 2025
- RLSA-2024:2853 Important: nodejs:20 security update Rocky Linux Security Advisories · Oct 9, 2025
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- ICSA-24-319-08 Siemens SINEC INS CISA ICS & IT advisories · Nov 12, 2024
- SSA-915275 SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3 Siemens ProductCERT · Nov 12, 2024
- ELSA-2024-2910 Important: nodejs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 22, 2024
- ELSA-2024-2853 Important: nodejs:20 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 16, 2024
- ELSA-2024-2779 Important: nodejs:18 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 14, 2024
- ELSA-2024-2780 Important: nodejs:18 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 10, 2024
- ELSA-2024-2778 Important: nodejs:20 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 9, 2024
- ALAS2023-2024-568 Moderate: nodejs security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 21, 2024
- ALAS2023-2024-544 Important: nodejs20 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 13, 2024