A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potentially leading to process termination, depending on the system configuration.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npm | May 13, 2024 | Mar 19, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs-docsUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-full-i18nUpgrade nodejs-develUpgrade nodejs20-debugsourceUpgrade nodejs20-develUpgrade nodejs-debuginfoUpgrade nodejs20-npmUpgrade nodejsUpgrade nodejs20Upgrade v8-11.3-develUpgrade nodejs20-libsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs20-debuginfoUpgrade nodejs-npmUpgrade nodejs-debugsourceUpgrade nodejs20-docsUpgrade nodejs-libs-debuginfoUpgrade v8-10.2-devel | Feb 17, 2025 | Mar 19, 2024 |
| Debian | — | Upgrade nodejs | Mar 28, 2024 | Mar 19, 2024 |
| Freebsd | — | Upgrade nodeUpgrade node21Upgrade node18Upgrade node20Upgrade node16 | Dec 10, 2025 | Mar 1, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Mar 19, 2024 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18n | May 9, 2024 | Mar 19, 2024 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nNo solution existsUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfo | May 13, 2024 | Mar 19, 2024 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-debuginfo | May 13, 2024 | Mar 19, 2024 |
| Suse | — | Upgrade nodejs20Upgrade nodejs14-docsUpgrade nodejs18-develUpgrade nodejs14Upgrade npm12Upgrade npm18Upgrade npm20Upgrade nodejs20-docsUpgrade nodejs12-develUpgrade nodejs16-docsUpgrade nodejs16-develUpgrade nodejs16Upgrade npm14Upgrade corepack20Upgrade npm16Upgrade nodejs18-docsUpgrade corepack18Upgrade nodejs12Upgrade nodejs12-docsUpgrade nodejs20-develUpgrade nodejs18Upgrade nodejs14-devel | Feb 29, 2024 | Feb 28, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 19, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub