Back Linuxsecurity

Critical Denial of Service Advisory for Node.js 20 on Fedora 42

Linuxsecurity •LinuxSecurity Advisories • January 31, 2026

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.} Update Information : Update to version 20.20.0

Node.js is a platform built on Chrome's JavaScript runtime \

for easily building fast, scalable network applications. \

Node.js uses an event-driven, non-blocking I/O model that \

makes it lightweight and efficient, perfect for data-intensive \

real-time applications that run across distributed devices.}

Update to version 20.20.0

* Mon Jan 19 2026 Jan Stan\u011bk - 1:20.20.0-2 - Diverge from rawhide * Tue Jan 13 2026 tjuhasz - 1:20.20.0-1 - Update to version 20.20.0 (rhbz#2428957) * Mon Dec 1 2025 tjuhasz - 1:20.19.6-1 - Update to version 20.19.6 (rhbz#2417008) * Wed Nov 12 2025 tjuhasz - 1:20.19.5-3 - Rebuild for nodejs-packaging

[ 1 ] Bug #2421304 - CVE-2025-62408 nodejs20: c-ares: Denial of Service due to query termination after maximum attempts [fedora-42] [ 2 ] Bug #2428957 - nodejs20-20.20.0 is available [ 3 ] Bug #2430294 - CVE-2026-22036 nodejs20: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion [fedora-42] [ 4 ] Bug #2431451 - CVE-2025-55132 nodejs20: Nodejs filesystem permissions bypass [fedora-42] [ 5 ] Bug #2431458 - CVE-2026-21637 nodejs20: Nodejs denial of service [fedora-42] [ 6 ] Bug #2431465 - CVE-2025-59466 nodejs20: Nodejs denial of service [fedora-42] Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-fb4878551d' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical DoS Resource Exhaustion Vulnerability in Node.js on Fedora 42 Multiple versions of Node.js (20, 22, and 24) have been identified with a critical denial of service (DoS) vulnerability affecting users on Fedora 42. The vulnerability can lead to resource exhaustion, necessitating updates to versions 20.20.0, 22.22.0, and 24.13.0 to mitigate the issue. 3 sources 59

Extracted Entities

Critical Denial of Service Advisory for Node.js 20 on Fedora 42

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (5)

Tools (1)