Latest nodejs node.js Vulnerabilities

A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges du...
Nodejs Node.js>=16.0.0<16.20.1
Nodejs Node.js>=18.0.0<18.16.1
Nodejs Node.js>=20.0.0<20.3.1
IBM Planning Analytics<=2.0
Node.js could allow a remote attacker to bypass security restrictions, caused by the circumvention of integrity checks by the policy feature. By sending a specially crafted request, an attacker could ...
Nodejs Node.js>=18.0.0<=18.18.1
Nodejs Node.js>=20.1.0<=20.8.0
Fedoraproject Fedora=37
Fedoraproject Fedora=38
Fedoraproject Fedora=39
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversa...
Nodejs Node.js>=20.0.0<20.8.0
Fedoraproject Fedora=39
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself again...
Nodejs Node.js>=20.0.0<20.8.0
- Rapid Reset HTTP/2 vulnerability
Microsoft Windows 11=21H2
Microsoft Windows 11=21H2
Microsoft Windows Server 2022
Microsoft Windows Server 2022
Microsoft Windows 11=22H2
Microsoft Windows 11=22H2
and 556 more
Node.js could allow a remote attacker to bypass security restrictions, caused by the use of the deprecated API process.binding(). By using a path traversal sequence, an attacker could exploit this vul...
Nodejs Node.js>=20.0.0<20.5.1
Nodejs Node.js>=20.0.0<=20.6.1
<=2.0
Node.js could allow a remote attacker to obtain sensitive information, caused by the failure to restrict file stats through the fs.statfs API in the permission model. By using the --allow-fs-read flag...
Nodejs Node.js>=20.0.0<20.5.1
Nodejs Node.js>=20.0.0<=20.6.1
<=2.0
Node.js could allow a remote attacker to bypass security restrictions, caused by the improper handling of Buffers in file system APIs within the experimental permission model. By specifying a path tra...
Nodejs Node.js>=20.0.0<=20.5.0
Fedoraproject Fedora=37
Fedoraproject Fedora=38
<=2.0
Node.js could allow a remote attacker to bypass security restrictions, caused by a missing getValidatedPath() check in the fs.mkdtemp() and fs.mkdtempSync() APIs. By using a path traversal attack, an ...
Nodejs Node.js>=20.0.0<=20.5.0
Fedoraproject Fedora=37
Fedoraproject Fedora=38
<=2.0
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the pol...
Nodejs Node.js>=16.0.0<=16.20.1
Nodejs Node.js>=18.0.0<=18.17.0
Nodejs Node.js>=20.0.0<=20.5.0
Node.js could allow a remote attacker to bypass security restrictions, caused by the use of module.constructor.createRequire(). By sending a specially crafted request, an attacker could exploit this v...
Nodejs Node.js>=16.0.0<=16.20.1
Nodejs Node.js>=18.0.0<=18.17.0
Nodejs Node.js>=20.0.0<=20.5.0
Fedoraproject Fedora=37
Fedoraproject Fedora=38
Node.js could allow a remote attacker to bypass security restrictions, caused by the use of Module._load(). By sending a specially crafted request, an attacker could exploit this vulnerability to bypa...
Nodejs Node.js>=16.0.0<=16.20.1
Nodejs Node.js>=18.0.0<=18.17.0
Nodejs Node.js>=20.0.0<=20.5.0
<=2.0
Node.js could provide weaker than expected security, caused by the failure to generate keys after setting a private key by the generateKeys() API function. By sending a specially crafted request, an a...
IBM Planning Analytics<=2.0
Nodejs Node.js>=16.0.0<16.20.1
Nodejs Node.js>=18.0.0<18.16.1
Nodejs Node.js>=20.0.0<20.3.1
ubuntu/nodejs<8.10.0~dfsg-2ubuntu0.4+
ubuntu/nodejs<10.19.0~dfsg-3ubuntu1.6
and 5 more
Node.js is vulnerable to a denial of service, caused by invalid public key information in x509 certificates. By accessing public key info of provided certificates from user code, an attacker could exp...
Nodejs Node.js>=16.0.0<16.20.1
Nodejs Node.js>=18.0.0<18.16.1
Nodejs Node.js>=20.0.0<20.3.1
IBM Cognos Analytics<=12.0.0-12.0.1
IBM Cognos Analytics<=11.2.0-11.2.4 FP2
IBM Cognos Analytics<=11.1.1-11.1.7 FP7
and 2 more
A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permissi...
Nodejs Node.js>=20.0.0<20.3.1
Nodejs Node.js=20.0.0
<=2.0
Node.js is vulnerable to HTTP request smuggling, caused by the failure to strictly use the CRLF sequence to delimit HTTP requests by the llhttp parser in the http module. By sending specially crafted ...
Nodejs Node.js=16.0.0
Nodejs Node.js=18.0.0
Nodejs Node.js=20.0.0
Nodejs Node.js=20.2.0
Fedoraproject Fedora=37
Fedoraproject Fedora=38
and 9 more
A vulnerability has been discovered in Node.js, where the use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition.
redhat/nodejs<18-9020020230717125503.rhel9
redhat/nodejs<1:16.20.1-1.el9_2
redhat/nodejs<1:16.20.2-1.el9_0
Nodejs Node.js>=16.0.0<16.20.1
Nodejs Node.js>=18.0.0<18.16.1
Nodejs Node.js>=20.0.0<20.3.1
and 1 more
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to f...
redhat/nodejs<18-9020020230327152102.rhel9
Nodejs Node.js>=14.0.0<=14.14.0
Nodejs Node.js>=14.0.0<14.21.3
Nodejs Node.js>=16.0.0<=16.12.0
Nodejs Node.js>=16.0.0<16.19.1
Nodejs Node.js>=18.0.0<=18.11.0
and 8 more
An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated priv...
redhat/nodejs<18-9020020230327152102.rhel9
redhat/nodejs<1:16.19.1-1.el9_2
redhat/nodejs<1:16.20.2-1.el9_0
redhat/rh-nodejs14<0:3.6-2.el7
redhat/rh-nodejs14-nodejs<0:14.21.3-2.el7
Nodejs Node.js>=14.0.0<=14.14.0
and 16 more
Node.js could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when enable the experimental permissions option with --experimental-policy. By sending a specially...
redhat/Node.js<19.6.1
redhat/Node.js<18.14.1
redhat/Node.js<16.19.1
redhat/Node.js<14.21.3
redhat/nodejs<18-9020020230327152102.rhel9
redhat/nodejs<1:16.19.1-1.el9_2
and 11 more
Node.js is vulnerable to CRLF injection, caused by a flaw in the fetch API. By sending a specially-crafted HTTP response containing CRLF character sequences, a remote attacker could exploit this vulne...
redhat/nodejs<18-9020020230327152102.rhel9
redhat/nodejs<1:16.19.1-1.el9_2
redhat/nodejs<1:16.20.2-1.el9_0
Nodejs Node.js>=16.0.0<16.19.1
Nodejs Node.js>=18.0.0<18.14.1
Nodejs Node.js>=19.0.0<19.6.1
and 2 more
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does no...
redhat/nodejs<18-9010020221118120946.rhel9
redhat/nodejs<1:16.18.1-3.el9_1
redhat/rh-nodejs14-nodejs<0:14.21.1-3.el7
redhat/rh-nodejs14-nodejs-nodemon<0:2.0.20-2.el7
debian/nodejs<=10.24.0~dfsg-1~deb10u1
Nodejs Node.js>=14.0.0<=14.14.0
and 8 more
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either ...
OpenSSL OpenSSL>=3.0.0<3.0.7
Fedoraproject Fedora=36
Fedoraproject Fedora=37
Nodejs Node.js>=18.0.0<18.11.0
Nodejs Node.js=18.12.0
Nodejs Node.js=19.0.0
and 3 more
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either ...
rust/openssl-src>=300.0.0<300.0.11
OpenSSL OpenSSL>=3.0.0<3.0.7
Fedoraproject Fedora=36
Fedoraproject Fedora=37
NetApp Clustered Data ONTAP
Fedoraproject Fedora=26
and 7 more
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems w...
redhat/nodejs<1:16.17.1-1.el9_0
Nodejs Node.js>=15.0.0<=15.14.0
Nodejs Node.js>=16.0.0<=16.12.0
Nodejs Node.js>=16.13.0<16.17.1
Nodejs Node.js>=18.0.0<18.9.1
Siemens Sinec Ins<1.0
and 5 more
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
redhat/nodejs<1:16.17.1-1.el9_0
redhat/nodejs<1:16.18.1-3.el9_1
redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7
Nodejs Node.js>=14.0.0<=14.14.0
Nodejs Node.js>=14.15.0<14.20.1
Nodejs Node.js>=16.0.0<=16.12.0
and 9 more
Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v1...
Vercel Next.js=12.2.3
Nodejs Node.js>=15.0.0
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Window...
Nodejs Node.js>=14.0.0<=14.14.0
Nodejs Node.js>=14.14.0<14.20.0
Nodejs Node.js>=16.0.0<=16.12.0
Nodejs Node.js>=16.13.0<16.16.0
Nodejs Node.js>=18.0.0<18.0.5
Microsoft Windows
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-ad...
Nodejs Node.js>=18.0.0<18.5.0
Siemens Sinec Ins<1.0
Siemens Sinec Ins=1.0
Siemens Sinec Ins=1.0-sp1
Siemens Sinec Ins=1.0-sp2
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly...
redhat/nodejs<14.20.0
redhat/nodejs<16.20.0
redhat/nodejs<18.5.0
redhat/nodejs<1:16.16.0-1.el9_0
redhat/rh-nodejs14-nodejs<0:14.20.0-2.el7
Nodejs Node.js>=14.0.0<=14.14.0
and 13 more
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
Llhttp Llhttp<2.1.5
Llhttp Llhttp>=6.0.0<6.0.7
Nodejs Node.js>=14.0.0<=14.14.0
Nodejs Node.js>=14.15.0<14.20.1
Nodejs Node.js>=16.0.0<=16.12.0
Nodejs Node.js>=16.13.0<16.17.1
and 15 more
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
Llhttp Llhttp<2.1.5
Llhttp Llhttp>=6.0.0<6.0.7
Nodejs Node.js>=14.0.0<=14.14.0
Nodejs Node.js>=14.15.0<14.20.0
Nodejs Node.js>=16.0.0<=16.12.0
Nodejs Node.js>=16.13.0<16.16.0
and 9 more
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
Llhttp Llhttp>=14.0.0<14.20.1
Llhttp Llhttp>=16.0.0<16.17.1
Llhttp Llhttp>=18.0.0<18.9.1
Nodejs Node.js>=14.0.0<=14.14.0
Nodejs Node.js>=14.15.0<14.20.0
Nodejs Node.js>=16.0.0<=16.12.0
and 16 more
A flaw was found in OpenSSL. It is possible to trigger an infinite loop by crafting a certificate that has invalid elliptic curve parameters. Since certificate parsing happens before verification of t...
redhat/jbcs-httpd24-apr-util<0:1.6.1-91.el8
redhat/jbcs-httpd24-curl<0:7.78.0-3.el8
redhat/jbcs-httpd24-httpd<0:2.4.37-80.el8
redhat/jbcs-httpd24-nghttp2<0:1.39.2-41.el8
redhat/jbcs-httpd24-openssl<1:1.1.1g-11.el8
redhat/jbcs-httpd24-openssl-chil<0:1.0.0-11.el8
and 84 more
Node.js could allow a remote attacker to bypass security restrictions, caused by the incorrect handling of multi-value Relative Distinguished Names. By crafting certificate subjects containing a singl...
redhat/rh-nodejs12-nodejs<0:12.22.12-2.el7
redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7
debian/nodejs<=10.24.0~dfsg-1~deb10u1<=10.24.0~dfsg-1~deb10u3
IBM Cognos Analytics 11.2.x<=IBM Cognos Analytics 11.2.x
IBM Cognos Analytics 11.1.x<=IBM Cognos Analytics 11.1.x
redhat/node<12.22.9
and 20 more
Node.js could allow a remote attacker to bypass security restrictions, caused by the improper handling of URI Subject Alternative Name (SAN) types. An attacker could exploit this vulnerability to bypa...
redhat/rh-nodejs12-nodejs<0:12.22.12-2.el7
redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7
debian/nodejs<=10.24.0~dfsg-1~deb10u1<=10.24.0~dfsg-1~deb10u3
IBM Cognos Analytics 11.2.x<=IBM Cognos Analytics 11.2.x
IBM Cognos Analytics 11.1.x<=IBM Cognos Analytics 11.1.x
redhat/node<12.22.9
and 18 more
Node.js could allow a remote attacker to bypass security restrictions, caused by a string injection vulnerability when name constraints were used within a certificate chain. An attacker could exploit ...
redhat/rh-nodejs12-nodejs<0:12.22.12-2.el7
redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7
debian/nodejs<=10.24.0~dfsg-1~deb10u1<=10.24.0~dfsg-1~deb10u3
IBM Cognos Analytics 11.2.x<=IBM Cognos Analytics 11.2.x
IBM Cognos Analytics 11.1.x<=IBM Cognos Analytics 11.1.x
redhat/node<12.22.9
and 19 more
Node.js could provide weaker than expected security, caused by an error related to the formatting logic of the console.table() function. An attacker could exploit this vulnerability using console.tabl...
redhat/rh-nodejs12-nodejs<0:12.22.12-2.el7
redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7
debian/nodejs<=10.24.0~dfsg-1~deb10u1
IBM Cognos Analytics 11.2.x<=IBM Cognos Analytics 11.2.x
IBM Cognos Analytics 11.1.x<=IBM Cognos Analytics 11.1.x
redhat/node<12.22.9
and 19 more
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (f...
rust/openssl-src>=300.0.0<300.0.4
OpenSSL OpenSSL<1.0.2
OpenSSL OpenSSL=1.1.0
OpenSSL OpenSSL=3.0.0
Netapp Cloud Backup
Netapp E-series Performance Analyzer
and 27 more
Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use N...
Nodejs Node.js>=15.0.0
Vercel Next.js>=11.1.0<11.1.3
Vercel Next.js>=12.0.0<12.0.5
npm/next>=0.9.9<11.1.3
npm/next>=12.0.0<12.0.5
Vercel Next.js>=11.1.0<11.1.3
and 2 more
Node.js could allow a remote attacker to bypass security restrictions, caused by an incomplete fix for CVE-2021-22930 related to a use-after-free on close http2 on stream canceling. An attacker could ...
redhat/rh-nodejs14-nodejs<0:14.17.5-1.el7
redhat/rh-nodejs12-nodejs<0:12.22.5-1.el7
redhat/rh-nodejs12-nodejs-nodemon<0:2.0.3-5.el7
redhat/nodejs<12.22.5
redhat/nodejs<14.17.5
redhat/nodejs<16.6.2
and 24 more
Node.js could allow a remote attacker to bypass security restrictions. If the https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, an attacker could exp...
redhat/rh-nodejs14-nodejs<0:14.17.5-1.el7
redhat/rh-nodejs12-nodejs<0:12.22.5-1.el7
redhat/rh-nodejs12-nodejs-nodemon<0:2.0.3-5.el7
redhat/nodejs<12.22.5
redhat/nodejs<14.17.5
redhat/nodejs<16.6.2
and 26 more
A flaw was found in Node.js. These vulnerabilities include remote code execution, Cross-site scripting (XSS), application crashes due to missing input validation of hostnames returned by Domain Name S...
redhat/rh-nodejs14-nodejs<0:14.17.5-1.el7
redhat/rh-nodejs12-nodejs<0:12.22.5-1.el7
redhat/rh-nodejs12-nodejs-nodemon<0:2.0.3-5.el7
redhat/nodejs<12.22.5
redhat/nodejs<14.17.5
redhat/nodejs<16.6.2
and 18 more
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Dom...
redhat/c-ares<1.17.2
redhat/c-ares<0:1.13.0-6.el8
redhat/rh-nodejs14-nodejs<0:14.17.5-1.el7
redhat/rh-nodejs12-nodejs<0:12.22.5-1.el7
redhat/rh-nodejs12-nodejs-nodemon<0:2.0.3-5.el7
>=1.0.0<1.17.2
and 69 more
Node.js could allow a remote attacker to bypass security restrictions, caused by a use-after-free on close http2 on stream canceling. An attacker could exploit this vulnerability to corrupt memory to ...
redhat/rh-nodejs14-nodejs<0:14.17.5-1.el7
redhat/rh-nodejs12-nodejs<0:12.22.5-1.el7
redhat/rh-nodejs12-nodejs-nodemon<0:2.0.3-5.el7
redhat/nodejs<12.22.4
redhat/nodejs<14.17.4
redhat/nodejs<16.6.0
and 12 more
Node.js could allow a local attacker to gain elevated privileges on the system, caused by improper configuration of permissions in the installation directory. Under certain conditions. An attacker cou...
Nodejs Node.js>=12.0.0<12.22.2
Nodejs Node.js>=14.0.0<14.17.2
Nodejs Node.js>=16.0.0<16.4.1
Microsoft Windows
Siemens Sinec Infrastructure Network Services<1.0.1.1
Node.js is vulnerable to a denial of service, caused by an out-of-bounds read in the libuv's uv__idna_toascii() function. By invoking the function using dns module's lookup() function, a remote attac...
>=12.0.0<12.22.2
>=14.0.0<14.17.2
>=16.0.0<16.4.1
<1.0.1.1
Nodejs Node.js>=12.0.0<12.22.2
Nodejs Node.js>=14.0.0<14.17.2
and 11 more
OpenSSL could allow a remote attacker to bypass security restrictions, caused by a missing check in the validation logic of X.509 certificate chains by the X509_V_FLAG_X509_STRICT flag. By using any v...
rust/openssl-src>=111.11.0<111.15.0
IBM Security Verify Access<=10.0.0
OpenSSL OpenSSL>=1.1.1h<1.1.1k
FreeBSD FreeBSD=12.2
FreeBSD FreeBSD=12.2-p1
FreeBSD FreeBSD=12.2-p2
and 52 more
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it...
rust/openssl-src<111.15.0
debian/openssl
IBM Cognos Analytics<=12.0.0-12.0.1
IBM Cognos Analytics<=11.2.0-11.2.4 FP2
IBM Cognos Analytics<=11.1.1-11.1.7 FP7
OpenSSL OpenSSL>=1.1.1<1.1.1k
and 202 more
Node.js is vulnerable to a denial of service, caused by a file descriptor leak. By making multiple attempts to connect with an 'unknownProtocol', an attacker could exploit this vulnerability to lead t...
redhat/rh-nodejs10-nodejs<0:10.24.0-1.el7
redhat/rh-nodejs14-nodejs<0:14.16.0-1.el7
redhat/rh-nodejs12-nodejs<0:12.21.0-1.el7
ubuntu/nodejs<10.19.0~dfsg-3ubuntu1.2
ubuntu/nodejs<12.21.0~dfsg-1
Nodejs Node.js>=10.0.0<10.24.0
and 17 more

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203