Important: nodejs:20 security update

2024-05-0900:00:00

errata.almalinux.org

node.js

security update

out of bounds read

dos

denial of service

http request smuggling

cve-2024-25629

cve-2024-28182

cve-2024-22025

cve-2024-27983

cve-2024-27982

unix

7.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.1%

JSON

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)
nghttp2: CONTINUATION frames DoS (CVE-2024-28182)
nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service (CVE-2024-22025)
nodejs: CONTINUATION frames DoS (CVE-2024-27983)
nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux8noarchnodejs-packaging< 2021.06-4.module_el8.9.0+3684+11b9e959nodejs-packaging-2021.06-4.module_el8.9.0+3684+11b9e959.noarch.rpm
almalinux8noarchnodejs-docs< 20.12.2-2.module_el8.9.0+3827+11b91f3enodejs-docs-20.12.2-2.module_el8.9.0+3827+11b91f3e.noarch.rpm
almalinux8noarchnodejs-nodemon< 3.0.1-1.module_el8.9.0+3731+490e3ce5nodejs-nodemon-3.0.1-1.module_el8.9.0+3731+490e3ce5.noarch.rpm
almalinux8noarchnodejs-packaging-bundler< 2021.06-4.module_el8.9.0+3684+11b9e959nodejs-packaging-bundler-2021.06-4.module_el8.9.0+3684+11b9e959.noarch.rpm
almalinux8x86_64nodejs< 20.12.2-2.module_el8.9.0+3827+11b91f3enodejs-20.12.2-2.module_el8.9.0+3827+11b91f3e.x86_64.rpm
almalinux8x86_64npm< 10.5.0-1.20.12.2.2.module_el8.9.0+3827+11b91f3enpm-10.5.0-1.20.12.2.2.module_el8.9.0+3827+11b91f3e.x86_64.rpm
almalinux8x86_64nodejs-devel< 20.12.2-2.module_el8.9.0+3827+11b91f3enodejs-devel-20.12.2-2.module_el8.9.0+3827+11b91f3e.x86_64.rpm
almalinux8x86_64nodejs-full-i18n< 20.12.2-2.module_el8.9.0+3827+11b91f3enodejs-full-i18n-20.12.2-2.module_el8.9.0+3827+11b91f3e.x86_64.rpm
almalinux8aarch64nodejs-devel< 20.12.2-2.module_el8.9.0+3827+11b91f3enodejs-devel-20.12.2-2.module_el8.9.0+3827+11b91f3e.aarch64.rpm
almalinux8aarch64nodejs< 20.12.2-2.module_el8.9.0+3827+11b91f3enodejs-20.12.2-2.module_el8.9.0+3827+11b91f3e.aarch64.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	8	noarch	nodejs-packaging	< 2021.06-4.module_el8.9.0+3684+11b9e959	nodejs-packaging-2021.06-4.module_el8.9.0+3684+11b9e959.noarch.rpm
almalinux	8	noarch	nodejs-docs	< 20.12.2-2.module_el8.9.0+3827+11b91f3e	nodejs-docs-20.12.2-2.module_el8.9.0+3827+11b91f3e.noarch.rpm
almalinux	8	noarch	nodejs-nodemon	< 3.0.1-1.module_el8.9.0+3731+490e3ce5	nodejs-nodemon-3.0.1-1.module_el8.9.0+3731+490e3ce5.noarch.rpm
almalinux	8	noarch	nodejs-packaging-bundler	< 2021.06-4.module_el8.9.0+3684+11b9e959	nodejs-packaging-bundler-2021.06-4.module_el8.9.0+3684+11b9e959.noarch.rpm
almalinux	8	x86_64	nodejs	< 20.12.2-2.module_el8.9.0+3827+11b91f3e	nodejs-20.12.2-2.module_el8.9.0+3827+11b91f3e.x86_64.rpm
almalinux	8	x86_64	npm	< 10.5.0-1.20.12.2.2.module_el8.9.0+3827+11b91f3e	npm-10.5.0-1.20.12.2.2.module_el8.9.0+3827+11b91f3e.x86_64.rpm
almalinux	8	x86_64	nodejs-devel	< 20.12.2-2.module_el8.9.0+3827+11b91f3e	nodejs-devel-20.12.2-2.module_el8.9.0+3827+11b91f3e.x86_64.rpm
almalinux	8	x86_64	nodejs-full-i18n	< 20.12.2-2.module_el8.9.0+3827+11b91f3e	nodejs-full-i18n-20.12.2-2.module_el8.9.0+3827+11b91f3e.x86_64.rpm
almalinux	8	aarch64	nodejs-devel	< 20.12.2-2.module_el8.9.0+3827+11b91f3e	nodejs-devel-20.12.2-2.module_el8.9.0+3827+11b91f3e.aarch64.rpm
almalinux	8	aarch64	nodejs	< 20.12.2-2.module_el8.9.0+3827+11b91f3e	nodejs-20.12.2-2.module_el8.9.0+3827+11b91f3e.aarch64.rpm