nodejs:24 security update
エラータID: AXSA:2026-189:01
リリース日:
2026/02/17 Tuesday - 16:17
題名:
nodejs:24 security update
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Node.js には、ファイルのアクセス権限の処理に不備があるため、
ローカルの攻撃者により、任意のファイルの読み込み、および書き込み
を可能とする脆弱性が存在します。(CVE-2025-55130)
- Node.js のバッファーの割り当てロジックには、タイムアウト
オプションを指定したうえで vm モジュールを利用している場合、
初期化されていないメモリ領域が割り当てられる問題があるため、
リモートの攻撃者により、割り当ての中断を介して、初期化前のメモリ
内容の漏洩を可能とする脆弱性が存在します。(CVE-2025-55131)
- Node.js のパーミッションモデルには、対象のプロセスが読み取り
権限のみ付与されている場合においても、futimes() 関数を利用して
意図せずファイルのアクセス権限およびタイムスタンプを変更できて
しまう問題があるため、ローカルの攻撃者により、タイムスタンプの
改ざん、および情報の漏洩を可能とする脆弱性が存在します。
(CVE-2025-55132)
- Node.js の TLS 接続の処理には、想定外の ECONNRESET エラーが
発生してしまう問題があるため、リモートの攻撃者により、不正な形式
の HTTP/2 HEADERS フレームと、大きすぎる HPACK データを持つように
細工されたデータの処理を介して、サービス拒否攻撃を可能とする脆弱性
が存在します。(CVE-2025-59465)
- Node.js のエラーハンドラには、async_hooks.createHook() 関数に
よるフックを有効化した場合、利用できるスタック領域のサイズの制限
を超過したことを検知できなくなることに起因したスタックオーバー
フローの問題があるため、リモートの攻撃者により、サービス拒否攻撃
(リソース枯渇) を可能とする脆弱性が存在します。(CVE-2025-59466)
- Node.js の TLS 処理スタックの pskCallback または ALPNCallback
を用いたエラーハンドラには、ファイルディスクリプタをリークさせて
しまう問題があるため、リモートの攻撃者により、サービス拒否攻撃
(TLS サーバーのクラッシュの発生、リソースの枯渇) を可能とする
脆弱性が存在します。(CVE-2026-21637)
Modularity name: nodejs
Stream name: 24
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2025-55130
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2025-55131
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
CVE-2025-55132
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2025-59465
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
CVE-2025-59466
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
CVE-2026-21637
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
追加情報:
N/A
ダウンロード:
SRPMS
- nodejs-nodemon-3.0.3-1.module+el8+1954+1170f031.src.rpm
MD5: 08135ea18cab8f6de0c1999a1c2c4740
SHA-256: 9b3e306b820e37d6d31f18e3c7a6f2b5376314acef22ffccbf925f87d96fd3d0
Size: 857.57 kB - nodejs-packaging-2021.06-6.module+el8+1954+1170f031.src.rpm
MD5: b020384018734cbdcdbe570fb76b2154
SHA-256: c7d5b776188da2d6a7ff3ff234b91bb038e070e7fef5966a54ff737d737dd1a6
Size: 30.68 kB - nodejs-24.13.0-0.module+el8+1954+1170f031.src.rpm
MD5: c2da1630e11ca6077fa60bd7b1bca9b3
SHA-256: 197f511a9e7f7a09eb05294c92d10a8fc85d3eef3f4489925c5d629df35fb3f3
Size: 93.47 MB
Asianux Server 8 for x86_64
- nodejs-24.13.0-0.module+el8+1954+1170f031.x86_64.rpm
MD5: 3539ceeb34b443fcf7741cd18d2c6e61
SHA-256: 50b1277fa648b7ca608a90cb15b476d7408e1f64df815bc0e9d5b82a67e8d364
Size: 66.39 kB - nodejs-debugsource-24.13.0-0.module+el8+1954+1170f031.x86_64.rpm
MD5: 324606c466a63fb531d1163b7f719b56
SHA-256: f432a5af039d7d56d9fe0b4b8472c196c0e2552752f3d84fe7b6b941c072bfe9
Size: 21.11 MB - nodejs-devel-24.13.0-0.module+el8+1954+1170f031.x86_64.rpm
MD5: 638f0d1f7f619258d0d888cfb2b613d1
SHA-256: f8fb195d938e4a03c4c284ff5563cfae289f1dd098f3c56c33af6847fc88357f
Size: 328.46 kB - nodejs-docs-24.13.0-0.module+el8+1954+1170f031.noarch.rpm
MD5: 928de1aecb6cf36653c13b2b4dffdeab
SHA-256: 3689c678f90a4c96d6fdd1a9357768aaccbd9772a1b7da9526d1e67a79ea2619
Size: 6.10 MB - nodejs-full-i18n-24.13.0-0.module+el8+1954+1170f031.x86_64.rpm
MD5: 995c1372ec27588dfb7cb2173c709474
SHA-256: 9bd968a63c345a63de440732805cbc2c19c572f1449bb2e3c90112ba46e99f41
Size: 8.33 MB - nodejs-libs-24.13.0-0.module+el8+1954+1170f031.x86_64.rpm
MD5: 20a28fb5f7290775089eb8297c4db88f
SHA-256: 3836b7052717c65a9c3770567c69119310ca2c43602b11dc96c3d7f9f9cf53fa
Size: 18.48 MB - nodejs-nodemon-3.0.3-1.module+el8+1954+1170f031.noarch.rpm
MD5: 08c64154257b1530463814363b4c494a
SHA-256: 1d0b7cabfb0248166386f59494f61e7546d613f9ac6b29241610d548910358c6
Size: 531.38 kB - nodejs-packaging-2021.06-6.module+el8+1954+1170f031.noarch.rpm
MD5: 378167c44e3dc3179b3a2a6527b2780d
SHA-256: e4b6dbadffe88df6cf9986fc27190d9d862ee0797eeaf741710ff5957a3959a0
Size: 24.41 kB - nodejs-packaging-bundler-2021.06-6.module+el8+1954+1170f031.noarch.rpm
MD5: 6ff415fc5bca1ae83fcad5c46180d7f4
SHA-256: a46f726fd038a66b4414dcc8634d0fbbda650d7d1febcaba9617d235044ae078
Size: 13.99 kB - npm-11.6.2-1.24.13.0.0.module+el8+1954+1170f031.noarch.rpm
MD5: 6f739f41cdcfb4f09b2e190bb9e32e3a
SHA-256: 68bf58c5558e8498583224b3a2cf80206af1e6a53fe701702628157e0b2410be
Size: 2.21 MB - v8-13.6-devel-13.6.233.17-1.24.13.0.0.module+el8+1954+1170f031.x86_64.rpm
MD5: b16e267d07e323bcbf95b23ce2254ceb
SHA-256: 0b820a5ca73ad545d134a0613682b65291655b3749c50d3d688b318bcda7033b
Size: 32.28 kB
English