ALAS2027-2026-333

References: CVE-2026-14257  CVE-2026-69152  CVE-2026-69192 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays. (CVE-2026-14257)

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9. (CVE-2026-69152)

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(), and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1. (CVE-2026-69192)

Issue Correction:
Run dnf update nodejs24 --releasever 2027.0.20261112 or dnf update --advisory ALAS2027-2026-333 --releasever 2027.0.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2027 documentation

New Packages:

aarch64:
    nodejs24-debugsource-24.22.0-1.amzn2027.0.1.aarch64
    nodejs24-debuginfo-24.22.0-1.amzn2027.0.1.aarch64
    nodejs24-libs-debuginfo-24.22.0-1.amzn2027.0.1.aarch64
    nodejs24-full-i18n-24.22.0-1.amzn2027.0.1.aarch64
    nodejs24-devel-24.22.0-1.amzn2027.0.1.aarch64
    v8-13.6-devel-13.6.233.17-1.24.22.0.1.amzn2027.0.1.aarch64
    nodejs24-24.22.0-1.amzn2027.0.1.aarch64
    nodejs24-libs-24.22.0-1.amzn2027.0.1.aarch64

noarch:
    nodejs24-docs-24.22.0-1.amzn2027.0.1.noarch
    nodejs24-npm-11.19.1-1.24.22.0.1.amzn2027.0.1.noarch

src:
    nodejs24-24.22.0-1.amzn2027.0.1.src

x86_64:
    nodejs24-debuginfo-24.22.0-1.amzn2027.0.1.x86_64
    nodejs24-devel-24.22.0-1.amzn2027.0.1.x86_64
    nodejs24-libs-debuginfo-24.22.0-1.amzn2027.0.1.x86_64
    nodejs24-full-i18n-24.22.0-1.amzn2027.0.1.x86_64
    v8-13.6-devel-13.6.233.17-1.24.22.0.1.amzn2027.0.1.x86_64
    nodejs24-24.22.0-1.amzn2027.0.1.x86_64
    nodejs24-libs-24.22.0-1.amzn2027.0.1.x86_64
    nodejs24-debugsource-24.22.0-1.amzn2027.0.1.x86_64