Amazon Linux 2023 Security Advisory: ALAS2023-2026-2060
Advisory Released Date: 2026-08-17
Advisory Updated Date: 2026-08-17
FAQs regarding Amazon Linux ALAS/CVE Severity
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work. (CVE-2026-13149)
undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0. (CVE-2026-15157)
undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty upstream can return a partial response with a mismatched framing header, close the socket early, and have the retry interceptor assemble a body of a different length while the original Content-Length stays attached. Applications that use the retry interceptor and forward upstream headers and bodies downstream, such as proxies or gateways, may then emit an invalid HTTP response with a stale Content-Length, leading to downstream response desynchronization, connection hangs, or response corruption. Exploitation requires the retry interceptor enabled, an upstream returning a mismatched partial response, and a downstream forwarder that does not remove or recalculate Content-Length. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0. (CVE-2026-16728)
undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0. (CVE-2026-16729)
A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer. (CVE-2026-50812)
HTTP/2 retained headers can bypass maxSessionMemory limits (CVE-2026-56846)
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. (CVE-2026-56847)
A flaw in Node.js HTTP/2 handling allows nghttp2_session_mem_send() to be called re-entrantly while nghttp2_session_mem_recv() is executing, resulting in a heap-use-after-free. (CVE-2026-56848)
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. (CVE-2026-56850)
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. (CVE-2026-58039)
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).
This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. (CVE-2026-58040)
A flaw in Node.js can cause dns.resolveAny() to abort the process when a DNS response contains more than 256 A records.
Repeated triggering of this condition can lead to denial of service. (CVE-2026-58042)
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist.
This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**. (CVE-2026-58043)
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http-parser-header-truncation-can-enable-request-smuggling-cve-2026-58044---low (CVE-2026-58044)
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodezlib-sync-apis-can-crash-on-spoofed-typedarray-length-cve-2026-58045---medium (CVE-2026-58045)
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19. (CVE-2026-59873)
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18. (CVE-2026-59874)
CPU-exhaustion denial of service via unbounded DNS name compression pointer chains (CVE-2026-69184)
Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function's regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process. (CVE-2026-9496)
Affected Packages:
nodejs22
Issue Correction:
Run dnf update nodejs22 --releasever 2023.12.20260817 or dnf update --advisory ALAS2023-2026-2060 --releasever 2023.12.20260817 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
v8-12.4-devel-12.4.254.21-1.22.23.2.1.amzn2023.0.2.aarch64
nodejs22-libs-22.23.2-1.amzn2023.0.2.aarch64
nodejs22-full-i18n-22.23.2-1.amzn2023.0.2.aarch64
nodejs22-libs-debuginfo-22.23.2-1.amzn2023.0.2.aarch64
nodejs22-debuginfo-22.23.2-1.amzn2023.0.2.aarch64
nodejs22-devel-22.23.2-1.amzn2023.0.2.aarch64
nodejs22-22.23.2-1.amzn2023.0.2.aarch64
nodejs22-npm-10.9.8-1.22.23.2.1.amzn2023.0.2.aarch64
nodejs22-debugsource-22.23.2-1.amzn2023.0.2.aarch64
noarch:
nodejs22-docs-22.23.2-1.amzn2023.0.2.noarch
src:
nodejs22-22.23.2-1.amzn2023.0.2.src
x86_64:
nodejs22-libs-debuginfo-22.23.2-1.amzn2023.0.2.x86_64
v8-12.4-devel-12.4.254.21-1.22.23.2.1.amzn2023.0.2.x86_64
nodejs22-debuginfo-22.23.2-1.amzn2023.0.2.x86_64
nodejs22-devel-22.23.2-1.amzn2023.0.2.x86_64
nodejs22-full-i18n-22.23.2-1.amzn2023.0.2.x86_64
nodejs22-22.23.2-1.amzn2023.0.2.x86_64
nodejs22-libs-22.23.2-1.amzn2023.0.2.x86_64
nodejs22-npm-10.9.8-1.22.23.2.1.amzn2023.0.2.x86_64
nodejs22-debugsource-22.23.2-1.amzn2023.0.2.x86_64