ALAS2023-2026-3297

References: CVE-2026-102276  CVE-2026-14257  CVE-2026-69152  CVE-2026-69192  CVE-2026-73566 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10. (CVE-2026-102276)

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays. (CVE-2026-14257)

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9. (CVE-2026-69152)

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1. (CVE-2026-69192)

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21. (CVE-2026-73566)

Issue Correction:
Run dnf update nodejs24 --releasever 2023.12.20261026 or dnf update --advisory ALAS2023-2026-3297 --releasever 2023.12.20261026 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    nodejs24-debuginfo-24.22.0-1.amzn2023.0.1.aarch64
    v8-13.6-devel-13.6.233.17-1.24.22.0.1.amzn2023.0.1.aarch64
    nodejs24-libs-debuginfo-24.22.0-1.amzn2023.0.1.aarch64
    nodejs24-full-i18n-24.22.0-1.amzn2023.0.1.aarch64
    nodejs24-devel-24.22.0-1.amzn2023.0.1.aarch64
    nodejs24-libs-24.22.0-1.amzn2023.0.1.aarch64
    nodejs24-24.22.0-1.amzn2023.0.1.aarch64
    nodejs24-debugsource-24.22.0-1.amzn2023.0.1.aarch64

noarch:
    nodejs24-docs-24.22.0-1.amzn2023.0.1.noarch
    nodejs24-npm-11.19.1-1.24.22.0.1.amzn2023.0.1.noarch

src:
    nodejs24-24.22.0-1.amzn2023.0.1.src

x86_64:
    nodejs24-debuginfo-24.22.0-1.amzn2023.0.1.x86_64
    nodejs24-libs-debuginfo-24.22.0-1.amzn2023.0.1.x86_64
    nodejs24-full-i18n-24.22.0-1.amzn2023.0.1.x86_64
    nodejs24-libs-24.22.0-1.amzn2023.0.1.x86_64
    v8-13.6-devel-13.6.233.17-1.24.22.0.1.amzn2023.0.1.x86_64
    nodejs24-devel-24.22.0-1.amzn2023.0.1.x86_64
    nodejs24-24.22.0-1.amzn2023.0.1.x86_64
    nodejs24-debugsource-24.22.0-1.amzn2023.0.1.x86_64