ALAS2023-2026-1404

References: CVE-2025-55130  CVE-2025-55131  CVE-2025-55132  CVE-2025-59464  CVE-2025-59465  CVE-2025-59466  CVE-2026-21637  CVE-2026-22036 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Bypass File System Permissions using crafted symlinks (CVE-2025-55130)

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption.

While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact. (CVE-2025-55131)

fs.futimes() Bypasses Read-Only Permission Model (CVE-2025-55132)

Memory leak that enables remote Denial of Service against applications processing TLS client certificates (CVE-2025-59464)

Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame (CVE-2025-59465)

Uncatchable "Maximum call stack size exceeded" error on Node.js via async_hooks leads to process crashes bypassing error handlers (CVE-2025-59466)

TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak

NOTE: https://nodejs.org/en/blog/vulnerability/december-2025-security-releases#tls-pskalpn-callback-exceptions-bypass-error-handlers-causing-dos-and-fd-leak-cve-2026-21637---medium (CVE-2026-21637)

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leading to high CPU usage and excessive memory allocation. This vulnerability is fixed in 7.18.0 and 6.23.0. (CVE-2026-22036)

Issue Correction:
Run dnf update nodejs24 --releasever 2023.10.20260202 or dnf update --advisory ALAS2023-2026-1404 --releasever 2023.10.20260202 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    nodejs24-libs-debuginfo-24.13.0-1.amzn2023.0.1.aarch64
    v8-13.6-devel-13.6.233.17-1.24.13.0.1.amzn2023.0.1.aarch64
    nodejs24-debuginfo-24.13.0-1.amzn2023.0.1.aarch64
    nodejs24-full-i18n-24.13.0-1.amzn2023.0.1.aarch64
    nodejs24-libs-24.13.0-1.amzn2023.0.1.aarch64
    nodejs24-24.13.0-1.amzn2023.0.1.aarch64
    nodejs24-devel-24.13.0-1.amzn2023.0.1.aarch64
    nodejs24-debugsource-24.13.0-1.amzn2023.0.1.aarch64

noarch:
    nodejs24-docs-24.13.0-1.amzn2023.0.1.noarch
    nodejs24-npm-11.6.2-1.24.13.0.1.amzn2023.0.1.noarch

src:
    nodejs24-24.13.0-1.amzn2023.0.1.src

x86_64:
    nodejs24-libs-debuginfo-24.13.0-1.amzn2023.0.1.x86_64
    nodejs24-full-i18n-24.13.0-1.amzn2023.0.1.x86_64
    nodejs24-libs-24.13.0-1.amzn2023.0.1.x86_64
    nodejs24-debuginfo-24.13.0-1.amzn2023.0.1.x86_64
    nodejs24-devel-24.13.0-1.amzn2023.0.1.x86_64
    v8-13.6-devel-13.6.233.17-1.24.13.0.1.amzn2023.0.1.x86_64
    nodejs24-24.13.0-1.amzn2023.0.1.x86_64
    nodejs24-debugsource-24.13.0-1.amzn2023.0.1.x86_64