nodejs:22 security update
エラータID: AXSA:2026-188:01
リリース日:
2026/02/17 Tuesday - 15:40
題名:
nodejs:22 security update
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Node.js には、ファイルのアクセス権限の処理に不備があるため、
ローカルの攻撃者により、任意のファイルの読み込み、および書き込み
を可能とする脆弱性が存在します。(CVE-2025-55130)
- Node.js のバッファーの割り当てロジックには、タイムアウト
オプションを指定したうえで vm モジュールを利用している場合、
初期化されていないメモリ領域が割り当てられる問題があるため、
リモートの攻撃者により、割り当ての中断を介して、初期化前のメモリ
内容の漏洩を可能とする脆弱性が存在します。(CVE-2025-55131)
- Node.js のパーミッションモデルには、対象のプロセスが読み取り
権限のみ付与されている場合においても、futimes() 関数を利用して
意図せずファイルのアクセス権限およびタイムスタンプを変更できて
しまう問題があるため、ローカルの攻撃者により、タイムスタンプの
改ざん、および情報の漏洩を可能とする脆弱性が存在します。
(CVE-2025-55132)
- Node.js の TLS 接続の処理には、想定外の ECONNRESET エラーが
発生してしまう問題があるため、リモートの攻撃者により、不正な形式
の HTTP/2 HEADERS フレームと、大きすぎる HPACK データを持つように
細工されたデータの処理を介して、サービス拒否攻撃を可能とする脆弱性
が存在します。(CVE-2025-59465)
- Node.js のエラーハンドラには、async_hooks.createHook() 関数に
よるフックを有効化した場合、利用できるスタック領域のサイズの制限
を超過したことを検知できなくなることに起因したスタックオーバー
フローの問題があるため、リモートの攻撃者により、サービス拒否攻撃
(リソース枯渇) を可能とする脆弱性が存在します。(CVE-2025-59466)
- Node.js の TLS 処理スタックの pskCallback または ALPNCallback
を用いたエラーハンドラには、ファイルディスクリプタをリークさせて
しまう問題があるため、リモートの攻撃者により、サービス拒否攻撃
(TLS サーバーのクラッシュの発生、リソースの枯渇) を可能とする
脆弱性が存在します。(CVE-2026-21637)
Modularity name: nodejs
Stream name: 22
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2025-55130
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2025-55131
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
CVE-2025-55132
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2025-59465
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
CVE-2025-59466
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
CVE-2026-21637
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
追加情報:
N/A
ダウンロード:
SRPMS
- nodejs-nodemon-3.0.1-1.module+el8+1953+3ec59c1e.src.rpm
MD5: 66a85034fa7705ac3a95aa9deafcb0f7
SHA-256: 6d8b5a2fe375e33726c082c29773edff8cc03766906a8c3ed15e097b0cf34966
Size: 340.07 kB - nodejs-packaging-2021.06-5.module+el8+1953+3ec59c1e.src.rpm
MD5: 902696eb76b756ccdc85d765b1401c63
SHA-256: 7694d4b95ae71af40d9cb6683130d9cd0f62be5b563380b4b18116b63c40db02
Size: 30.77 kB - nodejs-22.22.0-1.module+el8+1953+3ec59c1e.src.rpm
MD5: 2eb4d9ecd57df12b0526cd9e4ebb0426
SHA-256: a9f6182c0e4d9b504e97d7576b181f74cc65e412c7ebb94c3d8f71f9cd26c953
Size: 93.51 MB
Asianux Server 8 for x86_64
- nodejs-22.22.0-1.module+el8+1953+3ec59c1e.x86_64.rpm
MD5: ef25f02b15bf3be0daaaa0ed88507cdc
SHA-256: 2d3c13c71c7c689a75ff7bf3f4f1364fb0d4eb41ec77c3dc272c25c1a6704df4
Size: 2.10 MB - nodejs-debugsource-22.22.0-1.module+el8+1953+3ec59c1e.x86_64.rpm
MD5: 5d110b8845007618dfed51b892f5fbaa
SHA-256: 1a346dc71926bdc7c2f2c79a26effa683bd45040dbd42859d477cb9fb030512b
Size: 19.76 MB - nodejs-devel-22.22.0-1.module+el8+1953+3ec59c1e.x86_64.rpm
MD5: 1f9f2ffc741ed7d0d28490a06348ce35
SHA-256: eeb98a083e2baee0bf2a554b457835ca4fb9b19a463667b937e9828f5de0f5a5
Size: 268.76 kB - nodejs-docs-22.22.0-1.module+el8+1953+3ec59c1e.noarch.rpm
MD5: 355da486e16274ab3c7e438a7289808a
SHA-256: e388195f6f53b333fb3490396e3d40c2061ff212bd9f3a76815c7b5f498730a5
Size: 11.62 MB - nodejs-full-i18n-22.22.0-1.module+el8+1953+3ec59c1e.x86_64.rpm
MD5: 3abd660f30c2cb3280976d1af787c37d
SHA-256: ce8b4ac50535c10a94d798b37eb736a4992e9d77d88e117470ab95f2ce5f1660
Size: 8.32 MB - nodejs-libs-22.22.0-1.module+el8+1953+3ec59c1e.x86_64.rpm
MD5: f07b87509bc8389e3c863dd80b917f4b
SHA-256: 9569f52b4a6333ce3bd8d9e188249c9356ffc08c8caa65e3f89a9a52b75e08b0
Size: 20.65 MB - nodejs-nodemon-3.0.1-1.module+el8+1953+3ec59c1e.noarch.rpm
MD5: 4c853c72c5921a87ba515bb12d9f2414
SHA-256: d4d46b358e95a73c049c59827c6d79d3e973422383bac2c827a1412cbae21ee5
Size: 281.67 kB - nodejs-packaging-2021.06-5.module+el8+1953+3ec59c1e.noarch.rpm
MD5: 04c2d2aeee90d7630125dc91db43683c
SHA-256: 34fc904c4dee7ac4496fc4fa11e903f5e1928ced1d0941f4edafe4ee66e6b02f
Size: 24.34 kB - nodejs-packaging-bundler-2021.06-5.module+el8+1953+3ec59c1e.noarch.rpm
MD5: 8983b3d27ed7bdb28fb2b26390265be9
SHA-256: 3aa1289634e642a412e791cb35965fb0d775a503e679976080c1820d2bb328e2
Size: 13.96 kB - npm-10.9.4-1.22.22.0.1.module+el8+1953+3ec59c1e.x86_64.rpm
MD5: 44818f42e7e3e7be4341a324d8f3fff4
SHA-256: d5c1dd589187a7634d95c283584e814df468ad7a86811a33892a7067774723fb
Size: 2.26 MB - v8-12.4-devel-12.4.254.21-1.22.22.0.1.module+el8+1953+3ec59c1e.x86_64.rpm
MD5: 8fc8c4b73b87d7134fc8701ba4542567
SHA-256: 601fce12f2e9feba9969a2f0b2b4b3ff02a0429d572dbe9d32da62758ff52133
Size: 14.97 kB
English