ALAS2023-2026-2059: Security update for 10 packages

ALAS2023-2026-2059, released August 17, 2026, fixes 23 CVEs across 10 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

1 rated Critical

Exploited

None reported

Highest CVSS

9.1

Base score, 0 to 10

Highest EPSS

0.0064

51st percentile

Priority of the 23 CVEs

Patch now 0
                                Urgent 1
                                High 9
                                Routine 13

Fixed package versions

Product	Release	Fixed in
nodejs24	amzn 2023	1:24.18.1-1.amzn2023.0.2
nodejs24-debuginfo	amzn 2023	1:24.18.1-1.amzn2023.0.2
nodejs24-debugsource	amzn 2023	1:24.18.1-1.amzn2023.0.2
nodejs24-devel	amzn 2023	1:24.18.1-1.amzn2023.0.2
nodejs24-docs	amzn 2023	1:24.18.1-1.amzn2023.0.2
nodejs24-full-i18n	amzn 2023	1:24.18.1-1.amzn2023.0.2
nodejs24-libs	amzn 2023	1:24.18.1-1.amzn2023.0.2
nodejs24-libs-debuginfo	amzn 2023	1:24.18.1-1.amzn2023.0.2
nodejs24-npm	amzn 2023	1:11.16.0-1.24.18.1.1.amzn2023.0.2
v8-13.6-devel	amzn 2023	3:13.6.233.17-1.24.18.1.1.amzn2023.0.2

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-13697	node-undici: undici's cache interceptor mishandles malformed Cache-Control private directives	9.1	0.0057	None reported
High	CVE-2026-59871	node-tar: node-tar is a tar archive manipulation library for Node.js	7.5	0.0064	None reported
High	CVE-2026-59873	nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog...	7.5	0.0058	None reported
High	CVE-2026-56848	Node.js and 2 others: Use After Free	7.5	0.0057	None reported
High	CVE-2026-56846	Node.js and 2 others: Uncontrolled Resource Consumption	7.5	0.0050	None reported
High	CVE-2026-69184	c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains	7.5	0.0048	None reported
High	CVE-2026-59874	nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog...	7.5	0.0043	None reported
High	CVE-2026-14643	node-undici: undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or pr...	7.5	0.0040	None reported
High	CVE-2026-13149	nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog...	7.5	0.0036	None reported
High	CVE-2026-58043	Node.js 22 and 2 others: Improper Access Control - Generic	8.4	0.0014	None reported
Routine	CVE-2026-58042	Node.js and 2 others: Uncontrolled Resource Consumption	5.9	0.0037	None reported
Routine	CVE-2026-59875	node-tar: node-tar is a tar archive manipulation library for Node.js	5.3	0.0035	None reported
Routine	CVE-2026-16728	node-undici: undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed...	6.5	0.0029	None reported
Routine	CVE-2026-58041	Node.js and 2 others: Time-of-check Time-of-use (TOCTOU) Race Condition	5.3	0.0029	None reported
Routine	CVE-2026-16729	node-undici: undici's setCookie function does not fully sanitize cookie attributes	6.5	0.0028	None reported
Routine	CVE-2026-58040	Node.js and 2 others: Improper Validation of Certificate with Host Mismatch	6.3	0.0028	None reported
Routine	CVE-2026-58044	Node.js and 2 others: HTTP Request Smuggling	4.8	0.0027	None reported
Routine	CVE-2026-15157	node-undici: undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type...	5.4	0.0026	None reported
Routine	CVE-2026-58045	Node.js and 2 others: Uncontrolled Resource Consumption	6.2	0.0017	None reported
Routine	CVE-2026-56847	Node.js 22 and 2 others: Excessive Use of Unconditional Branching	6.1	0.0016	None reported
Routine	CVE-2026-53655	node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)	5.5	0.0016	None reported
Routine	CVE-2026-58039	Node.js and 2 others: Improper Access Control - Generic	4.4	0.0016	None reported
Routine	CVE-2026-56850	Node.js 22 and 2 others: Improper Authentication - Generic	4.4	0.0008	None reported

Also fixes CVE-2026-13697

DEBIAN-CVE-2026-13697
node-undici on Debian 14

Vendor advisory

https://alas.aws.amazon.com/AL2023/ALAS-2026-2059.html

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/alas2023-2026-2059">ALAS2023-2026-2059 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.