Latest Nodejs Vulnerabilities

● CVE-2023-30585

A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges du...

Nodejs Node.js>=16.0.0<16.20.1

Nodejs Node.js>=18.0.0<18.16.1

Nodejs Node.js>=20.0.0<20.3.1

IBM Planning Analytics<=2.0

● CVE-2023-38552

Node.js could allow a remote attacker to bypass security restrictions, caused by the circumvention of integrity checks by the policy feature. By sending a specially crafted request, an attacker could ...

Nodejs Node.js>=18.0.0<=18.18.1

Nodejs Node.js>=20.1.0<=20.8.0

Fedoraproject Fedora=37

Fedoraproject Fedora=38

Fedoraproject Fedora=39

● CVE-2023-39332

Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversa...

Nodejs Node.js>=20.0.0<20.8.0

Fedoraproject Fedora=39

● CVE-2023-39331

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself again...

Nodejs Node.js>=20.0.0<20.8.0

● CVE-2023-45143

Undici's cookie header not cleared on cross-origin redirect in fetch

Nodejs Undici<5.26.2

npm/undici<5.26.2

redhat/node-undici<5.26.2

Fedoraproject Fedora=37

Fedoraproject Fedora=38

Fedoraproject Fedora=39

● CVE-2023-44487

- Rapid Reset HTTP/2 vulnerability

Microsoft Windows 11=21H2

Microsoft Windows Server 2022

Microsoft Windows 11=22H2

and 556 more

● CVE-2023-32558

Node.js could allow a remote attacker to bypass security restrictions, caused by the use of the deprecated API process.binding(). By using a path traversal sequence, an attacker could exploit this vul...

Nodejs Node.js>=20.0.0<20.5.1

Nodejs Node.js>=20.0.0<=20.6.1

<=2.0

● CVE-2023-32005

Node.js could allow a remote attacker to obtain sensitive information, caused by the failure to restrict file stats through the fs.statfs API in the permission model. By using the --allow-fs-read flag...

Nodejs Node.js>=20.0.0<20.5.1

Nodejs Node.js>=20.0.0<=20.6.1

<=2.0

● CVE-2023-32004

Node.js could allow a remote attacker to bypass security restrictions, caused by the improper handling of Buffers in file system APIs within the experimental permission model. By specifying a path tra...

Nodejs Node.js>=20.0.0<=20.5.0

Fedoraproject Fedora=37

Fedoraproject Fedora=38

<=2.0

● CVE-2023-32003

Node.js could allow a remote attacker to bypass security restrictions, caused by a missing getValidatedPath() check in the fs.mkdtemp() and fs.mkdtempSync() APIs. By using a path traversal attack, an ...

Nodejs Node.js>=20.0.0<=20.5.0

Fedoraproject Fedora=37

Fedoraproject Fedora=38

<=2.0

● CVE-2023-32559

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the pol...

Nodejs Node.js>=16.0.0<=16.20.1

Nodejs Node.js>=18.0.0<=18.17.0

Nodejs Node.js>=20.0.0<=20.5.0

● CVE-2023-32006

Node.js could allow a remote attacker to bypass security restrictions, caused by the use of module.constructor.createRequire(). By sending a specially crafted request, an attacker could exploit this v...

Nodejs Node.js>=16.0.0<=16.20.1

Nodejs Node.js>=18.0.0<=18.17.0

Nodejs Node.js>=20.0.0<=20.5.0

Fedoraproject Fedora=37

Fedoraproject Fedora=38

● CVE-2023-32002

Node.js could allow a remote attacker to bypass security restrictions, caused by the use of Module._load(). By sending a specially crafted request, an attacker could exploit this vulnerability to bypa...

Nodejs Node.js>=16.0.0<=16.20.1

Nodejs Node.js>=18.0.0<=18.17.0

Nodejs Node.js>=20.0.0<=20.5.0

<=2.0

● CVE-2023-30590

Node.js could provide weaker than expected security, caused by the failure to generate keys after setting a private key by the generateKeys() API function. By sending a specially crafted request, an a...

IBM Planning Analytics<=2.0

Nodejs Node.js>=16.0.0<16.20.1

Nodejs Node.js>=18.0.0<18.16.1

Nodejs Node.js>=20.0.0<20.3.1

ubuntu/nodejs<8.10.0~dfsg-2ubuntu0.4+

ubuntu/nodejs<10.19.0~dfsg-3ubuntu1.6

and 5 more

● CVE-2023-30588

Node.js is vulnerable to a denial of service, caused by invalid public key information in x509 certificates. By accessing public key info of provided certificates from user code, an attacker could exp...

Nodejs Node.js>=16.0.0<16.20.1

Nodejs Node.js>=18.0.0<18.16.1

Nodejs Node.js>=20.0.0<20.3.1

IBM Cognos Analytics<=12.0.0-12.0.1

IBM Cognos Analytics<=11.2.0-11.2.4 FP2

IBM Cognos Analytics<=11.1.1-11.1.7 FP7

and 2 more

● CVE-2023-30586

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permissi...

Nodejs Node.js>=20.0.0<20.3.1

Nodejs Node.js=20.0.0

<=2.0

● CVE-2023-30589

Node.js is vulnerable to HTTP request smuggling, caused by the failure to strictly use the CRLF sequence to delimit HTTP requests by the llhttp parser in the http module. By sending specially crafted ...

Nodejs Node.js=16.0.0

Nodejs Node.js=18.0.0

Nodejs Node.js=20.0.0

Nodejs Node.js=20.2.0

Fedoraproject Fedora=37

Fedoraproject Fedora=38

and 9 more

● CVE-2023-30581

A vulnerability has been discovered in Node.js, where the use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition.

redhat/nodejs<18-9020020230717125503.rhel9

redhat/nodejs<1:16.20.1-1.el9_2

redhat/nodejs<1:16.20.2-1.el9_0

Nodejs Node.js>=16.0.0<16.20.1

Nodejs Node.js>=18.0.0<18.16.1

Nodejs Node.js>=20.0.0<20.3.1

and 1 more

● CVE-2023-23920

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated priv...

redhat/nodejs<18-9020020230327152102.rhel9

redhat/nodejs<1:16.19.1-1.el9_2

redhat/nodejs<1:16.20.2-1.el9_0

redhat/rh-nodejs14<0:3.6-2.el7

redhat/rh-nodejs14-nodejs<0:14.21.3-2.el7

Nodejs Node.js>=14.0.0<=14.14.0

and 16 more

● CVE-2023-23919

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to f...

redhat/nodejs<18-9020020230327152102.rhel9

Nodejs Node.js>=14.0.0<=14.14.0

Nodejs Node.js>=14.0.0<14.21.3

Nodejs Node.js>=16.0.0<=16.12.0

Nodejs Node.js>=16.0.0<16.19.1

Nodejs Node.js>=18.0.0<=18.11.0

and 8 more

● CVE-2023-23918

Node.js could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when enable the experimental permissions option with --experimental-policy. By sending a specially...

redhat/Node.js<19.6.1

redhat/Node.js<18.14.1

redhat/Node.js<16.19.1

redhat/Node.js<14.21.3

redhat/nodejs<18-9020020230327152102.rhel9

redhat/nodejs<1:16.19.1-1.el9_2

and 11 more

● CVE-2023-23936

Node.js is vulnerable to CRLF injection, caused by a flaw in the fetch API. By sending a specially-crafted HTTP response containing CRLF character sequences, a remote attacker could exploit this vulne...

redhat/nodejs<18-9020020230327152102.rhel9

redhat/nodejs<1:16.19.1-1.el9_2

redhat/nodejs<1:16.20.2-1.el9_0

Nodejs Node.js>=16.0.0<16.19.1

Nodejs Node.js>=18.0.0<18.14.1

Nodejs Node.js>=19.0.0<19.6.1

and 2 more

● CVE-2023-24807

Node.js is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the Headers.set() and Headers.append() methods in the fetch API. By sending a specially-c...

redhat/nodejs<18-9020020230327152102.rhel9

redhat/nodejs<1:16.19.1-1.el9_2

redhat/nodejs<1:16.20.2-1.el9_0

Nodejs Undici<5.19.1

IBM Cognos Dashboards on Cloud Pak for Data<=4.7.0

● CVE-2022-43548

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does no...

redhat/nodejs<18-9010020221118120946.rhel9

redhat/nodejs<1:16.18.1-3.el9_1

redhat/rh-nodejs14-nodejs<0:14.21.1-3.el7

redhat/rh-nodejs14-nodejs-nodemon<0:2.0.20-2.el7

debian/nodejs<=10.24.0~dfsg-1~deb10u1

Nodejs Node.js>=14.0.0<=14.14.0

and 8 more

● CVE-2022-3786

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either ...

OpenSSL OpenSSL>=3.0.0<3.0.7

Fedoraproject Fedora=36

Fedoraproject Fedora=37

Nodejs Node.js>=18.0.0<18.11.0

Nodejs Node.js=18.12.0

Nodejs Node.js=19.0.0

and 3 more

● CVE-2022-3602

rust/openssl-src>=300.0.0<300.0.11

OpenSSL OpenSSL>=3.0.0<3.0.7

Fedoraproject Fedora=36

Fedoraproject Fedora=37

NetApp Clustered Data ONTAP

Fedoraproject Fedora=26

and 7 more

● CVE-2022-35255

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems w...

redhat/nodejs<1:16.17.1-1.el9_0

Nodejs Node.js>=15.0.0<=15.14.0

Nodejs Node.js>=16.0.0<=16.12.0

Nodejs Node.js>=16.13.0<16.17.1

Nodejs Node.js>=18.0.0<18.9.1

Siemens Sinec Ins<1.0

and 5 more

● CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

redhat/nodejs<1:16.17.1-1.el9_0

redhat/nodejs<1:16.18.1-3.el9_1

redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7

Nodejs Node.js>=14.0.0<=14.14.0

Nodejs Node.js>=14.15.0<14.20.1

Nodejs Node.js>=16.0.0<=16.12.0

and 9 more

● CVE-2022-36046

Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v1...

Vercel Next.js=12.2.3

Nodejs Node.js>=15.0.0

● CVE-2022-35949

A Server-Side Request Forgery (SSRF) vulnerability was found in undici, a HTTP/1.1 client for Node.js. An attacker can manipulate the server-side application to make requests to an unintended location...

Nodejs Undici<=5.8.1

● CVE-2022-35948

A flaw was found in the undici package. When requesting unsanitized input on content-type headers, it is possible to inject additional requests via Carriage Return/Line Feed (CRLF).

Nodejs Undici<5.8.2

● CVE-2022-31151

A flaw was found in the undici package. After cookie headers are set, they are not cleared. This issue could allow an attacker to take advantage of this cookie, which could be used to control the redi...

Nodejs Undici<5.7.1

● CVE-2022-31150

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0....

Nodejs Undici<5.8.0

● CVE-2022-32222

A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-ad...

Nodejs Node.js>=18.0.0<18.5.0

Siemens Sinec Ins<1.0

Siemens Sinec Ins=1.0

Siemens Sinec Ins=1.0-sp1

Siemens Sinec Ins=1.0-sp2

● CVE-2022-32210

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if...

Nodejs Undici>=4.8.2<5.5.1

● CVE-2022-32223

Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Window...

Nodejs Node.js>=14.0.0<=14.14.0

Nodejs Node.js>=14.14.0<14.20.0

Nodejs Node.js>=16.0.0<=16.12.0

Nodejs Node.js>=16.13.0<16.16.0

Nodejs Node.js>=18.0.0<18.0.5

Microsoft Windows

● CVE-2022-32213

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Llhttp Llhttp<2.1.5

Llhttp Llhttp>=6.0.0<6.0.7

Nodejs Node.js>=14.0.0<=14.14.0

Nodejs Node.js>=14.15.0<14.20.1

Nodejs Node.js>=16.0.0<=16.12.0

Nodejs Node.js>=16.13.0<16.17.1

and 15 more

● CVE-2022-32212

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly...

redhat/nodejs<14.20.0

redhat/nodejs<16.20.0

redhat/nodejs<18.5.0

redhat/nodejs<1:16.16.0-1.el9_0

redhat/rh-nodejs14-nodejs<0:14.20.0-2.el7

Nodejs Node.js>=14.0.0<=14.14.0

and 13 more

● CVE-2022-32214

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

Llhttp Llhttp<2.1.5

Llhttp Llhttp>=6.0.0<6.0.7

Nodejs Node.js>=14.0.0<=14.14.0

Nodejs Node.js>=14.15.0<14.20.0

Nodejs Node.js>=16.0.0<=16.12.0

Nodejs Node.js>=16.13.0<16.16.0

and 9 more

● CVE-2022-32215

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

Llhttp Llhttp>=14.0.0<14.20.1

Llhttp Llhttp>=16.0.0<16.17.1

Llhttp Llhttp>=18.0.0<18.9.1

Nodejs Node.js>=14.0.0<=14.14.0

Nodejs Node.js>=14.15.0<14.20.0

Nodejs Node.js>=16.0.0<=16.12.0

and 16 more

● CVE-2022-0778

A flaw was found in OpenSSL. It is possible to trigger an infinite loop by crafting a certificate that has invalid elliptic curve parameters. Since certificate parsing happens before verification of t...

redhat/jbcs-httpd24-apr-util<0:1.6.1-91.el8

redhat/jbcs-httpd24-curl<0:7.78.0-3.el8

redhat/jbcs-httpd24-httpd<0:2.4.37-80.el8

redhat/jbcs-httpd24-nghttp2<0:1.39.2-41.el8

redhat/jbcs-httpd24-openssl<1:1.1.1g-11.el8

redhat/jbcs-httpd24-openssl-chil<0:1.0.0-11.el8

and 84 more

● CVE-2021-44531

Node.js could allow a remote attacker to bypass security restrictions, caused by the improper handling of URI Subject Alternative Name (SAN) types. An attacker could exploit this vulnerability to bypa...

redhat/rh-nodejs12-nodejs<0:12.22.12-2.el7

redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7

debian/nodejs<=10.24.0~dfsg-1~deb10u1<=10.24.0~dfsg-1~deb10u3

IBM Cognos Analytics 11.2.x<=IBM Cognos Analytics 11.2.x

IBM Cognos Analytics 11.1.x<=IBM Cognos Analytics 11.1.x

redhat/node<12.22.9

and 18 more

● CVE-2021-44532

Node.js could allow a remote attacker to bypass security restrictions, caused by a string injection vulnerability when name constraints were used within a certificate chain. An attacker could exploit ...

redhat/rh-nodejs12-nodejs<0:12.22.12-2.el7

redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7

debian/nodejs<=10.24.0~dfsg-1~deb10u1<=10.24.0~dfsg-1~deb10u3

IBM Cognos Analytics 11.2.x<=IBM Cognos Analytics 11.2.x

IBM Cognos Analytics 11.1.x<=IBM Cognos Analytics 11.1.x

redhat/node<12.22.9

and 19 more

● CVE-2022-21824

Node.js could provide weaker than expected security, caused by an error related to the formatting logic of the console.table() function. An attacker could exploit this vulnerability using console.tabl...

redhat/rh-nodejs12-nodejs<0:12.22.12-2.el7

redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7

debian/nodejs<=10.24.0~dfsg-1~deb10u1

IBM Cognos Analytics 11.2.x<=IBM Cognos Analytics 11.2.x

IBM Cognos Analytics 11.1.x<=IBM Cognos Analytics 11.1.x

redhat/node<12.22.9

and 19 more

● CVE-2021-44533

Node.js could allow a remote attacker to bypass security restrictions, caused by the incorrect handling of multi-value Relative Distinguished Names. By crafting certificate subjects containing a singl...

redhat/rh-nodejs12-nodejs<0:12.22.12-2.el7

redhat/rh-nodejs14-nodejs<0:14.20.1-2.el7

debian/nodejs<=10.24.0~dfsg-1~deb10u1<=10.24.0~dfsg-1~deb10u3

IBM Cognos Analytics 11.2.x<=IBM Cognos Analytics 11.2.x

IBM Cognos Analytics 11.1.x<=IBM Cognos Analytics 11.1.x

redhat/node<12.22.9

and 20 more

● CVE-2021-4044

Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (f...

rust/openssl-src>=300.0.0<300.0.4

OpenSSL OpenSSL<1.0.2

OpenSSL OpenSSL=1.1.0

OpenSSL OpenSSL=3.0.0

Netapp Cloud Backup

Netapp E-series Performance Analyzer

and 27 more

● CVE-2021-43803

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use N...

Nodejs Node.js>=15.0.0

Vercel Next.js>=11.1.0<11.1.3

Vercel Next.js>=12.0.0<12.0.5

npm/next>=0.9.9<11.1.3

npm/next>=12.0.0<12.0.5

Vercel Next.js>=11.1.0<11.1.3

and 2 more

● CVE-2021-22939

Node.js could allow a remote attacker to bypass security restrictions. If the https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, an attacker could exp...

redhat/rh-nodejs14-nodejs<0:14.17.5-1.el7

redhat/rh-nodejs12-nodejs<0:12.22.5-1.el7

redhat/rh-nodejs12-nodejs-nodemon<0:2.0.3-5.el7

redhat/nodejs<12.22.5

redhat/nodejs<14.17.5

redhat/nodejs<16.6.2

and 26 more

● CVE-2021-22931

A flaw was found in Node.js. These vulnerabilities include remote code execution, Cross-site scripting (XSS), application crashes due to missing input validation of hostnames returned by Domain Name S...

redhat/rh-nodejs14-nodejs<0:14.17.5-1.el7

redhat/rh-nodejs12-nodejs<0:12.22.5-1.el7

redhat/rh-nodejs12-nodejs-nodemon<0:2.0.3-5.el7

redhat/nodejs<12.22.5

redhat/nodejs<14.17.5

redhat/nodejs<16.6.2

and 18 more

● CVE-2021-22940

Node.js could allow a remote attacker to bypass security restrictions, caused by an incomplete fix for CVE-2021-22930 related to a use-after-free on close http2 on stream canceling. An attacker could ...

redhat/rh-nodejs14-nodejs<0:14.17.5-1.el7

redhat/rh-nodejs12-nodejs<0:12.22.5-1.el7

redhat/rh-nodejs12-nodejs-nodemon<0:2.0.3-5.el7

redhat/nodejs<12.22.5

redhat/nodejs<14.17.5

redhat/nodejs<16.6.2

and 24 more

Latest Nodejs Vulnerabilities

Company

Resources

Contact