The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potentially leading to process termination, depending on the system configuration.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packaging | May 13, 2024 | Mar 19, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs20-libsUpgrade nodejs20-debuginfoUpgrade nodejs-npmUpgrade nodejsUpgrade nodejs20Upgrade nodejs-libs-debuginfoUpgrade nodejs20-docsUpgrade nodejs20-npmUpgrade nodejs-debugsourceUpgrade v8-10.2-develUpgrade v8-11.3-develUpgrade nodejs-develUpgrade nodejs20-debugsourceUpgrade nodejs-docsUpgrade nodejs20-full-i18nUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-develUpgrade nodejs-debuginfo | Feb 17, 2025 | Mar 19, 2024 |
| Debian | — | Upgrade nodejs | Mar 28, 2024 | Mar 19, 2024 |
| Freebsd | — | Upgrade nodeUpgrade node21Upgrade node18Upgrade node16Upgrade node20 | Dec 10, 2025 | Mar 1, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Mar 19, 2024 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18n | May 9, 2024 | Mar 19, 2024 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-develNo solution existsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-nodemon | May 13, 2024 | Mar 19, 2024 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-develUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfo | May 13, 2024 | Mar 19, 2024 |
| Suse | — | Upgrade nodejs12-develUpgrade npm14Upgrade nodejs18Upgrade nodejs20-develUpgrade nodejs12-docsUpgrade nodejs16-docsUpgrade nodejs18-docsUpgrade corepack20Upgrade nodejs16-develUpgrade corepack18Upgrade npm16Upgrade nodejs12Upgrade nodejs14-develUpgrade nodejs16Upgrade nodejs20-docsUpgrade nodejs18-develUpgrade nodejs14Upgrade npm12Upgrade nodejs14-docsUpgrade nodejs20Upgrade npm18Upgrade npm20 | Feb 29, 2024 | Feb 28, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 19, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub