Node.js Vulnerabilities Allow DoS, Bypass, Info Disclosure

CERT-Bund has released a security advisory (WID-SEC-2026-0843) concerning multiple vulnerabilities in Open Source Node.js versions prior to 20.20.2, 22.22.2, 24.14.1, and 25.8.2. These vulnerabilities, with a CVSS Base Score of 7.5 (high) and Temporal Score of 6.5 (medium), can be exploited remotely to cause denial of service, bypass security controls, and disclose sensitive information.

Affected systems include Linux, UNIX, and Windows environments. Organizations utilizing these Node.js versions should apply the provided mitigations, which involve updating to a patched version. The advisory highlights the critical nature of these vulnerabilities and the potential for significant security breaches if not addressed promptly.