Skip to content
OpenAdvisories
High · 7.5 CVE-2026-48933 EUVD-2026-39609GHSA-pvpp-9x2p-fxg3

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerabili…

Published Jun 26, 2026 · Updated Aug 10, 2026 · Assigned by hackerone

Description

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Affected products

VendorProductAffectedFixed
nodejs node 22.22.3 – ≤ 22.22.3, 24.16.0 – ≤ 24.16.0, 26.3.0 – ≤ 26.3.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 nodejs 24.17.0+dfsg+~cs24.13.2-1 —
Debian 13 nodejs 20.19.2+dfsg-1+deb13u3 —
Debian 12 nodejs 18.20.4+dfsg-1~deb12u3 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 nodejs No fix yet —
Ubuntu 26.04 LTS nodejs No fix yet —
Ubuntu 25.10 nodejs No fix yet —
Ubuntu 24.04 LTS nodejs No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS nodejs No fix yet —
Ubuntu Pro 20.04 LTS nodejs No fix yet —
Ubuntu Pro 18.04 LTS nodejs No fix yet —
Ubuntu Pro 16.04 LTS nodejs No fix yet —
Ubuntu Pro 14.04 LTS nodejs No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 nodejs +5 1:22.23.1-2.el10_2 RHSA-2026:35842
RHEL 10 nodejs-npm 1:10.9.8-1.22.23.1.2.el10_2 RHSA-2026:35842
RHEL 10 nodejs24 +4 1:24.18.0-1.el10_2 RHSA-2026:35841
RHEL 10 nodejs24-npm 1:11.16.0-1.24.18.0.1.el10_2 RHSA-2026:35841
RHEL 9 nodejs +4 1:22.23.1-1.module+el9.8.0+24457+996af7aa RHSA-2026:35892, RHSA-2026:35891
RHEL 9 nodejs-nodemon 3.0.1-1.module+el9.8.0+24156+bb41d456 RHSA-2026:35892, RHSA-2026:35891
RHEL 9 nodejs-packaging +1 2021.06-6.module+el9.8.0+24156+bb41d456 RHSA-2026:35892, RHSA-2026:35891
RHEL 9 npm 1:10.9.8-1.22.23.1.1.module+el9.8.0+24457+996af7aa RHSA-2026:35892, RHSA-2026:35891
RHEL 9 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.module+el9.8.0+24457+996af7aa RHSA-2026:35892
RHEL 9 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.module+el9.8.0+24456+b244c3b4 RHSA-2026:35891
RHEL 8 nodejs +4 1:22.23.1-1.module+el8.10.0+24500+8eb51621 RHSA-2026:41947, RHSA-2026:39868
RHEL 8 nodejs-nodemon 3.0.1-1.module+el8.10.0+24500+8eb51621 RHSA-2026:41947, RHSA-2026:39868
RHEL 8 nodejs-packaging +1 2021.06-6.module+el8.10.0+24190+49a46c75 RHSA-2026:41947, RHSA-2026:39868
RHEL 8 npm 1:10.9.8-1.22.23.1.1.module+el8.10.0+24500+8eb51621 RHSA-2026:41947, RHSA-2026:39868
RHEL 8 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.module+el8.10.0+24500+8eb51621 RHSA-2026:41947
RHEL 8 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.module+el8.10.0+24481+7a71fac8 RHSA-2026:39868
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS nodejs +5 1:22.23.1-2.el10_0 RHSA-2026:39246
RHEL 10.0 EUS nodejs-npm 1:10.9.8-1.22.23.1.2.el10_0 RHSA-2026:39246
RHEL 9.6 EUS nodejs +4 1:22.23.1-2.module+el9.6.0+24604+449f851b RHSA-2026:52399
RHEL 9.6 EUS nodejs-nodemon 3.1.14-1.module+el9.6.0+24604+449f851b RHSA-2026:52399
RHEL 9.6 EUS nodejs-packaging +1 2021.06-4.module+el9.6.0+23473+45664c2d RHSA-2026:52399
RHEL 9.6 EUS npm 1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b RHSA-2026:52399
RHEL 9.6 EUS v8-12.4-devel 3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b RHSA-2026:52399
Red Hat Hardened Images 1 nodejs20 +6 20.20.2-1.hum1 RHSA-2026:9455
Red Hat Hardened Images 1 nodejs20-npm 10.8.2-1.20.20.2.1.hum1 RHSA-2026:9455
Red Hat Hardened Images 1 nodejs22 +6 22.23.1-1.hum1 RHSA-2026:28727
Red Hat Hardened Images 1 nodejs22-npm 10.9.8-1.22.23.1.1.hum1 RHSA-2026:28727
Red Hat Hardened Images 1 nodejs24 +6 24.18.0-0.1.hum1 RHSA-2026:29012
Red Hat Hardened Images 1 nodejs24-npm 11.16.0-1.24.18.0.0.1.hum1 RHSA-2026:29012
Red Hat Hardened Images 1 nodejs25 +6 25.9.0-1.1.hum1 RHSA-2026:7378
Red Hat Hardened Images 1 nodejs25-npm 11.12.1-1.25.9.0.1.1.hum1 RHSA-2026:7378
Red Hat Hardened Images 1 nodejs26 +6 26.4.0-1.2.hum1 RHSA-2026:30172
Red Hat Hardened Images 1 nodejs26-npm 11.17.0-1.26.4.0.1.2.hum1 RHSA-2026:30172

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 nodejs +4 1:22.23.1-2.el10_2 ALSA-2026:35842
AlmaLinux 10 nodejs-npm 1:10.9.8-1.22.23.1.2.el10_2 ALSA-2026:35842
AlmaLinux 10 nodejs24 +4 1:24.18.0-1.el10_2 ALSA-2026:35841
AlmaLinux 10 nodejs24-npm 1:11.16.0-1.24.18.0.1.el10_2 ALSA-2026:35841
AlmaLinux 9 nodejs +4 1:22.23.1-1.module_el9.8.0+276+8b329b47 ALSA-2026:35892, ALSA-2026:35891
AlmaLinux 9 nodejs-nodemon 3.0.1-1.module_el9.7.0+208+fb06c0ab ALSA-2026:35892, ALSA-2026:35891
AlmaLinux 9 nodejs-packaging +1 2021.06-6.module_el9.7.0+209+ecf6523e ALSA-2026:35892, ALSA-2026:35891
AlmaLinux 9 npm 1:10.9.8-1.22.23.1.1.module_el9.8.0+276+8b329b47 ALSA-2026:35892, ALSA-2026:35891
AlmaLinux 9 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.module_el9.8.0+276+8b329b47 ALSA-2026:35892
AlmaLinux 9 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.module_el9.8.0+277+61fc613e ALSA-2026:35891
AlmaLinux 8 nodejs +4 1:22.23.1-1.module_el8.10.0+4231+1bf2f855 ALSA-2026:41947, ALSA-2026:39868
AlmaLinux 8 nodejs-nodemon 3.0.1-1.module_el8.10.0+3956+47c9ee9f ALSA-2026:41947, ALSA-2026:39868
AlmaLinux 8 nodejs-packaging +1 2021.06-6.module_el8.10.0+4086+70facd4a ALSA-2026:41947, ALSA-2026:39868
AlmaLinux 8 npm 1:10.9.8-1.22.23.1.1.module_el8.10.0+4231+1bf2f855 ALSA-2026:41947, ALSA-2026:39868
AlmaLinux 8 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.module_el8.10.0+4231+1bf2f855 ALSA-2026:41947
AlmaLinux 8 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.module_el8.10.0+4228+2938bc94 ALSA-2026:39868

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 nodejs22 1:22.23.1-2.el10_2 RLSA-2026:35842
Rocky Linux 10 nodejs24 1:24.18.0-1.el10_2 RLSA-2026:35841
Rocky Linux 9 nodejs-nodemon 3.0.1-1.module+el9.7.0+40022+9ecc286c RLSA-2026:97855, RLSA-2026:35892, RLSA-2026:35891
Rocky Linux 9 nodejs-packaging 2021.06-6.module+el9.7.0+40052+e32ea525 RLSA-2026:97855, RLSA-2026:35892, RLSA-2026:35891
Rocky Linux 8 nodejs 1:24.18.0-1.module+el8.10.0+40252+a58646bc RLSA-2026:39868
Rocky Linux 8 nodejs-nodemon 3.0.1-1.module+el8.9.0+1760+903d54b9 RLSA-2026:41947, RLSA-2026:39868
Rocky Linux 8 nodejs-packaging 2021.06-6.module+el8.10.0+40048+6d99f608 RLSA-2026:41947, RLSA-2026:39868
ReleasePackageFixed inAdvisory
SLES 15 SP7 nodejs22 22.23.0-150700.3.12.1 SUSE-SU-2026:2695-1
SLES 15 SP7 nodejs24 24.17.0-150700.15.11.1 SUSE-SU-2026:2633-1
SLES 15 SP6 nodejs20 20.20.2-150600.3.21.1 SUSE-SU-2026:3929-1
SLES 15 SP6 nodejs22 22.23.0-150600.13.18.1 SUSE-SU-2026:2647-1
SLES 15 SP5 nodejs18 18.20.8-150400.9.39.1 SUSE-SU-2026:4261-1
SLES 15 SP5 nodejs20 20.20.2-150500.11.30.1 SUSE-SU-2026:3930-1
SLES 15 SP4 nodejs16 16.20.2-150400.3.42.1 SUSE-SU-2026:4355-1
SLES 15 SP4 nodejs18 18.20.8-150400.9.39.1 SUSE-SU-2026:4261-1
SLES 12 SP5 nodejs18 18.20.8-8.44.1 SUSE-SU-2026:4248-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 nodejs22 22.23.0-160000.1.1 SUSE-SU-2026:22368-1
SLES for SAP 16.0 nodejs24 24.18.0-160000.1.1 SUSE-SU-2026:22565-1
SLES for SAP 15 SP6 nodejs20 20.20.2-150600.3.21.1 SUSE-SU-2026:3929-1
SLES for SAP 15 SP6 nodejs22 22.23.0-150600.13.18.1 SUSE-SU-2026:2647-1
SLES for SAP 15 SP5 nodejs18 18.20.8-150400.9.39.1 SUSE-SU-2026:4261-1
SLES for SAP 15 SP5 nodejs20 20.20.2-150500.11.30.1 SUSE-SU-2026:3930-1
SLES for SAP 15 SP4 nodejs16 16.20.2-150400.3.42.1 SUSE-SU-2026:4355-1
SLES for SAP 15 SP4 nodejs18 18.20.8-150400.9.39.1 SUSE-SU-2026:4261-1
SLES 16.0 nodejs22 22.23.0-160000.1.1 SUSE-SU-2026:22368-1
SLES 16.0 nodejs24 24.18.0-160000.1.1 SUSE-SU-2026:22565-1
SLE HPC 15 SP5 nodejs18 18.20.8-150400.9.39.1 SUSE-SU-2026:4261-1
SLE HPC 15 SP5 nodejs20 20.20.2-150500.11.30.1 SUSE-SU-2026:3930-1
SLE HPC 15 SP4 nodejs16 16.20.2-150400.3.42.1 SUSE-SU-2026:4355-1
SLE HPC 15 SP4 nodejs18 18.20.8-150400.9.39.1 SUSE-SU-2026:4261-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed nodejs24 24.17.0-1.1 openSUSE-SU-2026:11121-1
openSUSE Tumbleweed nodejs26 26.3.1-1.1 openSUSE-SU-2026:11110-1
openSUSE Leap 16.0 nodejs22 22.23.0-160000.1.1 openSUSE-SU-2026:21058-1
openSUSE Leap 16.0 nodejs24 24.18.0-160000.1.1 openSUSE-SU-2026:21236-1
ReleasePackageFixed inAdvisory
Alpine v3.24 nodejs 24.17.0-r0 —
Alpine v3.23 nodejs 24.17.0-r0 —
Alpine v3.22 nodejs 22.23.0-r0 —
Alpine v3.21 nodejs 22.23.0-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 nodejs22 +4 1:22.23.1-1.amzn2023.0.1 ALAS2023-2026-1921
Amazon Linux 2023 nodejs22-npm 1:10.9.8-1.22.23.1.1.amzn2023.0.1 ALAS2023-2026-1921
Amazon Linux 2023 nodejs24 +4 1:24.18.0-1.amzn2023.0.1 ALAS2023-2026-1920
Amazon Linux 2023 nodejs24-npm 1:11.16.0-1.24.18.0.1.amzn2023.0.1 ALAS2023-2026-1920
Amazon Linux 2023 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.amzn2023.0.1 ALAS2023-2026-1921
Amazon Linux 2023 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.amzn2023.0.1 ALAS2023-2026-1920

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 nodejs 24.17.0-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 nodejs +4 1:22.23.1-2.el10_2 ELSA-2026-35842
Oracle Linux 10 nodejs-npm 1:10.9.8-1.22.23.1.2.el10_2 ELSA-2026-35842
Oracle Linux 10 nodejs24 +4 1:24.18.0-1.0.1.el10_2 ELSA-2026-35841
Oracle Linux 10 nodejs24-npm 1:11.16.0-1.24.18.0.1.0.1.el10_2 ELSA-2026-35841
Oracle Linux 9 nodejs +4 1:22.23.1-1.module+el9.8.0+90947+d3e8e647 ELSA-2026-35892, ELSA-2026-35891
Oracle Linux 9 nodejs-nodemon 3.0.1-1.module+el9.8.0+90947+d3e8e647 ELSA-2026-35892, ELSA-2026-35891
Oracle Linux 9 nodejs-packaging +1 2021.06-6.module+el9.8.0+90946+13dc792a ELSA-2026-35892, ELSA-2026-35891
Oracle Linux 9 npm 1:10.9.8-1.22.23.1.1.module+el9.8.0+90947+d3e8e647 ELSA-2026-35892, ELSA-2026-35891
Oracle Linux 9 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.module+el9.8.0+90947+d3e8e647 ELSA-2026-35892
Oracle Linux 9 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.module+el9.8.0+90946+13dc792a ELSA-2026-35891
Oracle Linux 8 nodejs +4 1:22.23.1-1.module+el8.10.0+90968+e271b286 ELSA-2026-41947, ELSA-2026-39868
Oracle Linux 8 nodejs-nodemon 3.0.1-1.module+el8.10.0+90968+e271b286 ELSA-2026-41947, ELSA-2026-39868
Oracle Linux 8 nodejs-packaging +1 2021.06-4.module+el8.10.0+90968+e271b286 ELSA-2026-41947, ELSA-2026-39868
Oracle Linux 8 npm 1:10.9.8-1.22.23.1.1.module+el8.10.0+90968+e271b286 ELSA-2026-41947, ELSA-2026-39868
Oracle Linux 8 v8-12.4-devel 3:12.4.254.21-1.22.23.1.1.module+el8.10.0+90968+e271b286 ELSA-2026-41947
Oracle Linux 8 v8-13.6-devel 3:13.6.233.17-1.24.18.0.1.module+el8.10.0+90961+a86f8457 ELSA-2026-39868

Advisories 50

References