nodejs:24 security update
エラータID: AXSA:2026-209:01
リリース日:
2026/02/20 Friday - 15:31
題名:
nodejs:24 security update
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Node.js には、ファイルのアクセス権限の処理に不備があるため、
ローカルの攻撃者により、任意のファイルの読み込み、および書き込み
を可能とする脆弱性が存在します。(CVE-2025-55130)
- Node.js のバッファーの割り当てロジックには、タイムアウト
オプションを指定したうえで vm モジュールを利用している場合、
初期化されていないメモリ領域が割り当てられる問題があるため、
リモートの攻撃者により、割り当ての中断を介して、初期化前のメモリ
内容の漏洩を可能とする脆弱性が存在します。(CVE-2025-55131)
- Node.js のパーミッションモデルには、対象のプロセスが読み取り
権限のみ付与されている場合においても、futimes() 関数を利用して
意図せずファイルのアクセス権限およびタイムスタンプを変更できて
しまう問題があるため、ローカルの攻撃者により、タイムスタンプの
改ざん、および情報の漏洩を可能とする脆弱性が存在します。
(CVE-2025-55132)
- Node.js の TLS 接続の処理には、想定外の ECONNRESET エラーが
発生してしまう問題があるため、リモートの攻撃者により、不正な形式
の HTTP/2 HEADERS フレームと、大きすぎる HPACK データを持つように
細工されたデータの処理を介して、サービス拒否攻撃を可能とする脆弱性
が存在します。(CVE-2025-59465)
- Node.js のエラーハンドラには、async_hooks.createHook() 関数に
よるフックを有効化した場合、利用できるスタック領域のサイズの制限
を超過したことを検知できなくなることに起因したスタックオーバー
フローの問題があるため、リモートの攻撃者により、サービス拒否攻撃
(リソース枯渇) を可能とする脆弱性が存在します。(CVE-2025-59466)
- Node.js の TLS 処理スタックの pskCallback または ALPNCallback
を用いたエラーハンドラには、ファイルディスクリプタをリークさせて
しまう問題があるため、リモートの攻撃者により、サービス拒否攻撃
(TLS サーバーのクラッシュの発生、リソースの枯渇) を可能とする
脆弱性が存在します。(CVE-2026-21637)
Modularity name: nodejs
Stream name: 24
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2025-55130
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2025-55131
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
CVE-2025-55132
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2025-59465
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
CVE-2025-59466
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
CVE-2026-21637
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
追加情報:
N/A
ダウンロード:
SRPMS
- nodejs-nodemon-3.0.3-3.module+el9+1130+ef5cad62.src.rpm
MD5: 7b972cc1f7024e3cb1d3259249d25a42
SHA-256: 3479f30be98846863de3313f02e95a1e155e722671b94586c5a41d2b65045955
Size: 858.61 kB - nodejs-packaging-2021.06-6.module+el9+1130+ef5cad62.src.rpm
MD5: e3731d9f9f564a6b7f976dabcbb20c2e
SHA-256: 7bbfb6d5cf3188a5f5b7f5513b99aaf5128cd97053f7d449328ac61d08d8d9f0
Size: 25.41 kB - nodejs-24.13.0-1.module+el9+1130+ef5cad62.src.rpm
MD5: 0ae4d36d546af73cc1c27e1eca5264d6
SHA-256: 3ea15d08499d6a8626275480bce365926be852f6a816ff064185057d5e3000db
Size: 93.47 MB
Asianux Server 9 for x86_64
- nodejs-24.13.0-1.module+el9+1130+ef5cad62.x86_64.rpm
MD5: aea80b3963f931264a4bfbb9c4648ddf
SHA-256: 9bd96f3596471d8a315c12a050a4b8b2ca8e7365d025c24fc58432a9e5893877
Size: 65.76 kB - nodejs-debugsource-24.13.0-1.module+el9+1130+ef5cad62.x86_64.rpm
MD5: eee9a044dc29c03f160dab8dc8e40a97
SHA-256: d28ecc1c034f2d1933c23cab97cddc4702db64f1798844e899369f57ee4e420f
Size: 19.07 MB - nodejs-devel-24.13.0-1.module+el9+1130+ef5cad62.x86_64.rpm
MD5: fdb3fc947a7448ef128660fb2ff40cad
SHA-256: 0dac483bd7287e516c364b12e1bae013a1d6ac028da3a4bd59b85af494c6d10a
Size: 331.48 kB - nodejs-docs-24.13.0-1.module+el9+1130+ef5cad62.noarch.rpm
MD5: 7997f973277abaea41be6a6393babfa6
SHA-256: e9a237569bb72b2bbafa8c9c28ac4bc754a6cc5c5b9c9ecc926076ba8f9bc3e8
Size: 4.90 MB - nodejs-full-i18n-24.13.0-1.module+el9+1130+ef5cad62.x86_64.rpm
MD5: f6bb5e1bd346870ede197c50f68971fc
SHA-256: 28da0e32baccd1e12c37dd6cbdd295cbc52c8d87600c03926db32b52fcc1cba1
Size: 8.58 MB - nodejs-libs-24.13.0-1.module+el9+1130+ef5cad62.x86_64.rpm
MD5: 7d229d5f92fe3b8622f10eb1a8e612c5
SHA-256: eb16ed67b8fda3e1377507da2e2406048b4f8b909e927c6bc575ed346c5e2cc0
Size: 18.12 MB - nodejs-nodemon-3.0.3-3.module+el9+1130+ef5cad62.noarch.rpm
MD5: 9f4086d534736d1beb2a7f7295a6e259
SHA-256: 5e921c1e57b4d943e658bf3506e0c9116f09f788b9f76b39a9a7b5e8d4e09b40
Size: 584.93 kB - nodejs-packaging-2021.06-6.module+el9+1130+ef5cad62.noarch.rpm
MD5: e34cbf78a3a644fc74fdc3364eed06a6
SHA-256: 13e57efff812918cebefbc0b2f296c999d9e09aad0093b0606ddf1e13ad60ac0
Size: 18.66 kB - nodejs-packaging-bundler-2021.06-6.module+el9+1130+ef5cad62.noarch.rpm
MD5: c8df88bb399c0d698a8f505a67e6b446
SHA-256: 558542d9e2feec60e07ef3c7cc592dcb41b849d51fa760d14d139a1499ae1ee2
Size: 8.47 kB - npm-11.6.2-1.24.13.0.1.module+el9+1130+ef5cad62.noarch.rpm
MD5: 71cf18486f1af3903492a0fc193554e5
SHA-256: 3fc28ebf461cc08649feee8de5f666d1d8713a3e04576596ce34d929f982809c
Size: 2.35 MB - v8-13.6-devel-13.6.233.17-1.24.13.0.1.module+el9+1130+ef5cad62.x86_64.rpm
MD5: 6a1a67a9a35c8bd159501578148f7677
SHA-256: f6777d241bef1e09d3ad5a7e6940bcd01b498c5175b8ca807af673b6f55a4ae0
Size: 32.26 kB
English