nodejs:24 security update
エラータID: AXSA:2026-1559:01
リリース日:
2026/08/18 Tuesday - 16:28
題名:
nodejs:24 security update
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- brace-expansion には、正規表現の不備に起因して意図せずリソース
を消費してしまう問題があるため、リモートの攻撃者により、サービス
拒否攻撃 (DoS) を可能とする脆弱性が存在します。(CVE-2026-13149)
- Node.js の node-tar ライブラリには、リソースの制限を実施して
いない問題があるため、リモートの攻撃者により、巧妙に細工された
gzip ファイルを介して、サービス拒否攻撃 (DoS) を可能とする脆弱性
が存在します。(CVE-2026-59873)
- Node.js の node-tar ライブラリには、無限ループの発生に至る
問題があるため、リモートの攻撃者により、巧妙に細工された tar
ファイルを介して、サービス拒否攻撃 (DoS) を可能とする脆弱性が
存在します。(CVE-2026-59874)
Modularity name: nodejs
Stream name: 24
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-13149
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.
CVE-2026-59873
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.
CVE-2026-59874
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.
追加情報:
N/A
ダウンロード:
SRPMS
- nodejs-nodemon-3.1.14-2.module+el9+1181+87da6d4a.src.rpm
MD5: 572b27bcec945b1d34c25401f1028f18
SHA-256: 8caa5d788b299de09530cf48947cf429ecdd27b455ca11e7daa1e3c632844859
Size: 454.13 kB - nodejs-packaging-2021.06-6.module+el9+1181+87da6d4a.src.rpm
MD5: 7561d398a93d04ff9e2895ca50b1e8da
SHA-256: a8a3bb44964cf353f29bc9c616d7c7d2a5b1d15ace1e3eff9791f8bdd36dad07
Size: 25.41 kB - nodejs-24.18.0-3.module+el9+1181+87da6d4a.src.rpm
MD5: 50467a6a9a20cd0f220dbe00e879b0dd
SHA-256: 9276404c90011d220445fdca715894422a6cf7abe443370be3e83089d44b7265
Size: 98.87 MB
Asianux Server 9 for x86_64
- nodejs-24.18.0-3.module+el9+1181+87da6d4a.x86_64.rpm
MD5: f0d11971639f9813193b4e2e2ec5a8ff
SHA-256: a33f5a9f8d2a65b9d5c555de12c9272e27f093eb49d6508ff4db2ad41afb6dd6
Size: 67.22 kB - nodejs-debugsource-24.18.0-3.module+el9+1181+87da6d4a.x86_64.rpm
MD5: 9ec33b2706790b342befa3244f6a0469
SHA-256: 9eacf80624418c025e79a3910c54ebb0cb73b3ebb9a9dd37b1303c01943a2962
Size: 19.37 MB - nodejs-devel-24.18.0-3.module+el9+1181+87da6d4a.x86_64.rpm
MD5: f9ca83e97127d2f592239b36e9e21a5d
SHA-256: 0363823931ffd9a9740e72b861330628b0e4829e93a4dece36ca2a8f71dd0d63
Size: 333.48 kB - nodejs-docs-24.18.0-3.module+el9+1181+87da6d4a.noarch.rpm
MD5: bf97ad493f2b507b8e5c3c4148eaeb12
SHA-256: fe769e697cb46da013c331ee1cd4cd346b371687d97a546d815a9ab847c4950c
Size: 5.07 MB - nodejs-full-i18n-24.18.0-3.module+el9+1181+87da6d4a.x86_64.rpm
MD5: 4e91b423ead3c3827b011f2e69671977
SHA-256: e64ba4e6ea7c0698c9056844bcd323fc15cac67396934e49e0f638e861081fd8
Size: 8.87 MB - nodejs-libs-24.18.0-3.module+el9+1181+87da6d4a.x86_64.rpm
MD5: 35936167ca87d28c6be0ba6fe06c3365
SHA-256: 9ad5c0ac5f6ebb2b539f84e83fdd53126b02c8a1dcebd9e16d08d67538a2888a
Size: 18.46 MB - nodejs-nodemon-3.1.14-2.module+el9+1181+87da6d4a.noarch.rpm
MD5: a9834f1baad9edd23615969f7e7ee574
SHA-256: b9c589977c751d0b2821cc59c88cb3add374c0d8c5ff871bbd774a2cf573fdee
Size: 373.87 kB - nodejs-packaging-2021.06-6.module+el9+1181+87da6d4a.noarch.rpm
MD5: bbe2a9a165209fa827ee702d2b3539d7
SHA-256: 3660e3ed68fc348bbd65b43ea867812bc5ff3566982a905fe4cc37287e8002a8
Size: 18.66 kB - nodejs-packaging-bundler-2021.06-6.module+el9+1181+87da6d4a.noarch.rpm
MD5: 5adfec3f4bc2f3a67689d958c3467ec5
SHA-256: 1a64ccb5daf75c56e85293775b5e9c498fbf5d200c8cd8eaeedf658e3d856bfc
Size: 8.47 kB - npm-11.16.0-1.24.18.0.3.module+el9+1181+87da6d4a.noarch.rpm
MD5: 4834d262a39a3fb2598fb7ae41c622b0
SHA-256: b211ce8ba0a9327ccbbecfe8b6e6351070fa76399ab65cabdbecef5aea7a3dc7
Size: 2.49 MB - v8-13.6-devel-13.6.233.17-1.24.18.0.3.module+el9+1181+87da6d4a.x86_64.rpm
MD5: 0fc7bb24b83aa456b8aa4b71c161dec6
SHA-256: 69e5bec400ffa5e5bc59a7297d5ee2b17e43d641ee7951f9e6db7eda366b4b5a
Size: 33.41 kB
English