nodejs:22 security update
エラータID: AXSA:2026-212:01
リリース日:
2026/02/20 Friday - 16:12
題名:
nodejs:22 security update
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Node.js には、ファイルのアクセス権限の処理に不備があるため、
ローカルの攻撃者により、任意のファイルの読み込み、および書き込み
を可能とする脆弱性が存在します。(CVE-2025-55130)
- Node.js のバッファーの割り当てロジックには、タイムアウト
オプションを指定したうえで vm モジュールを利用している場合、
初期化されていないメモリ領域が割り当てられる問題があるため、
リモートの攻撃者により、割り当ての中断を介して、初期化前のメモリ
内容の漏洩を可能とする脆弱性が存在します。(CVE-2025-55131)
- Node.js のパーミッションモデルには、対象のプロセスが読み取り
権限のみ付与されている場合においても、futimes() 関数を利用して
意図せずファイルのアクセス権限およびタイムスタンプを変更できて
しまう問題があるため、ローカルの攻撃者により、タイムスタンプの
改ざん、および情報の漏洩を可能とする脆弱性が存在します。
(CVE-2025-55132)
- Node.js の TLS 接続の処理には、想定外の ECONNRESET エラーが
発生してしまう問題があるため、リモートの攻撃者により、不正な形式
の HTTP/2 HEADERS フレームと、大きすぎる HPACK データを持つように
細工されたデータの処理を介して、サービス拒否攻撃を可能とする脆弱性
が存在します。(CVE-2025-59465)
- Node.js のエラーハンドラには、async_hooks.createHook() 関数に
よるフックを有効化した場合、利用できるスタック領域のサイズの制限
を超過したことを検知できなくなることに起因したスタックオーバー
フローの問題があるため、リモートの攻撃者により、サービス拒否攻撃
(リソース枯渇) を可能とする脆弱性が存在します。(CVE-2025-59466)
- Node.js の TLS 処理スタックの pskCallback または ALPNCallback
を用いたエラーハンドラには、ファイルディスクリプタをリークさせて
しまう問題があるため、リモートの攻撃者により、サービス拒否攻撃
(TLS サーバーのクラッシュの発生、リソースの枯渇) を可能とする
脆弱性が存在します。(CVE-2026-21637)
Modularity name: nodejs
Stream name: 22
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2025-55130
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2025-55131
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.
CVE-2025-55132
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVE-2025-59465
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example: ``` server.on('secureConnection', socket => { socket.on('error', err => { console.log(err) }) }) ```
CVE-2025-59466
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
CVE-2026-21637
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
追加情報:
N/A
ダウンロード:
SRPMS
- nodejs-nodemon-3.0.1-1.module+el9+1129+0ff5f486.src.rpm
MD5: b2ec998ae5bf9e91292415e8e6616d72
SHA-256: 450496a2c145a67d3debbe5e083780cbe798b54438dc95e255337fb3fc4d0313
Size: 339.27 kB - nodejs-packaging-2021.06-5.module+el9+1129+0ff5f486.src.rpm
MD5: 5b17941637e4e1a273fe89ec2cbbad8c
SHA-256: 110ec843cde13f7310935bbba9d3118e47ab5ae8ec2a0b5323ebbd16dd990314
Size: 25.17 kB - nodejs-22.22.0-1.module+el9+1129+0ff5f486.src.rpm
MD5: 0032818e8c451d0b4652ccfccffa9b51
SHA-256: c0f5d831c5ebc2ce8c7ec129b7743d2a0e0b63312dbc69074dc56a9ea6a18692
Size: 90.54 MB
Asianux Server 9 for x86_64
- nodejs-22.22.0-1.module+el9+1129+0ff5f486.x86_64.rpm
MD5: f3a53e215191d3c55114ff9cac2aef4f
SHA-256: 105bc1fa14c5bff3b6c1c33742256043d85599d7c005de958e53a97ba30daad5
Size: 2.28 MB - nodejs-debugsource-22.22.0-1.module+el9+1129+0ff5f486.x86_64.rpm
MD5: 345490381cd7cb653f522b78272354f6
SHA-256: ec7bff9f52aff856f6438001b0e5248b4d6b785e8e0abb6189532672645414a8
Size: 17.91 MB - nodejs-devel-22.22.0-1.module+el9+1129+0ff5f486.x86_64.rpm
MD5: bbaa7c12e732b5a8f0070b2a4b2362c5
SHA-256: 202cf4f4231975cb92e730b13e85eed78cd306e051e7590d8c63856d22a21d20
Size: 275.91 kB - nodejs-docs-22.22.0-1.module+el9+1129+0ff5f486.noarch.rpm
MD5: df088a277cf444372018c0034c355c6e
SHA-256: d79d2ecbf61bc17908d88920790fb37bcaa0adb2836981f370412963c5fe274e
Size: 9.20 MB - nodejs-full-i18n-22.22.0-1.module+el9+1129+0ff5f486.x86_64.rpm
MD5: c4a79f502ad476e5756e241ca5e232b2
SHA-256: 319b6bc0f15b4282fa387e18bb9341d25c7d4437ebc0105832bf8bfcebe263f4
Size: 8.60 MB - nodejs-libs-22.22.0-1.module+el9+1129+0ff5f486.x86_64.rpm
MD5: 62f0b05000ab60b23b8caff6bf77872e
SHA-256: 7cd9dfce799f5e5ca52f6e58256b3b5c9282e4fa980be1c97999a1a9d341ffb0
Size: 20.49 MB - nodejs-nodemon-3.0.1-1.module+el9+1129+0ff5f486.noarch.rpm
MD5: 4d04900c5e69649ba9b47dace479f72d
SHA-256: cdfe6f762f8f011237ed5073b54bb4790a2f7912165a1469c770307155b36e2f
Size: 332.31 kB - nodejs-packaging-2021.06-5.module+el9+1129+0ff5f486.noarch.rpm
MD5: 3e3f7835c0fda2b2dde9d3fe527d27a0
SHA-256: 5b4b23ab7399efda64b1886d19aefded873e1e8740100042b8f47aa33ffedfb5
Size: 18.50 kB - nodejs-packaging-bundler-2021.06-5.module+el9+1129+0ff5f486.noarch.rpm
MD5: 51076e8d70224c6340bc348f0807282c
SHA-256: 05e353e5035ef3c4a9ee9b31f35fbc32176a32fefe944c0d4f55db6b53bc90a1
Size: 8.34 kB - npm-10.9.4-1.22.22.0.1.module+el9+1129+0ff5f486.x86_64.rpm
MD5: d32628cf6854f93e3ba92fce9930dfba
SHA-256: e07be0e37c90acd77b603ca20bd7b9447476129b1eee966ef9c3ff9680f6227c
Size: 2.47 MB - v8-12.4-devel-12.4.254.21-1.22.22.0.1.module+el9+1129+0ff5f486.x86_64.rpm
MD5: cd63e99653db2cdd2087637d52e20f8a
SHA-256: e852ffca9e8225f46aaf1278b5726747cae8899ca096435fc40449d191738bc9
Size: 14.83 kB
English