AZL-26938 CVE-2023-31130 affecting package nodejs for versions less than 16.20.1-2

c-ares is an asynchronous resolver library. aresinetnetpton is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to...

Node.js: OpenSSL error handling issues in nodejs crypto library

A cryptographic vulnerability exists in Node.js 19.2.0, 18.14.1, 16.19.1, 14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread...

vm2 注入漏洞

vm2 is an advanced virtual machine/sandbox for Node.js by individual developer Patrik Simek in the Czech Republic. to run untrusted code using whitelisted Node built-in modules. An injection vulnerability exists in versions prior to vm2 3.9.17, which stems from an exception cleanup presence...

RSSHub 跨站脚本漏洞

RSSHub is an RSS feed generator written in Node.js, distributed under the MIT license and maintained by DIYgod and other GitHub users. A cross-site scripting vulnerability exists in RSSHub. An attacker can exploit this vulnerability to execute arbitrary JavaScript code...

PT-2023-12423 · Unknown · Serenityos

Name of the Vulnerable Software and Affected Versions: SerenityOS affected versions not specified Description: A critical issue has been found in SerenityOS, affecting the function initialize typed array from array buffer in the library Userland/Libraries/LibJS/Runtime/TypedArray.cpp. This issue...

Node.js 安全漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js that stems from the presence of an elevation of privilege vulnerability that can be exploited by an attacker to bypass authentication and access unauthorized modules...

SUSE CVE-2019-13617

njs through 0.3.3, used in NGINX, has a heap-based buffer over-read in nxtvsprintf in nxt/nxtsprintf.c during error handling, as demonstrated by an njsregexpliteral call that leads to an njsparserlexererror call and then an njsparserscopeerror call...

The vulnerability of JavaScript Node.js in a cross-platform execution environment, related to improper handling of exceptional situations, allows a violator to trigger a service failure.

The vulnerability of JavaScript Node.js’ cross-platform execution environment is related to incorrect exception handling in the src/nodeoptions-inl.h file when an invalid command-line argument is provided as input. Exploiting this vulnerability can allow a remote attacker to cause an application ...

nodejs: HTTP request smuggling due to improper delimiting of header fields

A vulnerability was found in NodeJS due to the llhttp parser in the http module not strictly using the CRLF sequence to delimit HTTP requests. This issue can lead to HTTP Request Smuggling HRS. This flaw allows an attacker to send a specially crafted HTTP request to the server and smuggle arbitra...

AZL-41051 CVE-2022-32213 affecting package rust for versions less than 1.75.0-1

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling HRS...

The vulnerability of the njs_set_number() function in the njs interpreter of the nginx server allows a hacker to cause a service failure.

The vulnerability of the njssetnumber function in the njs interpreter of the nginx server is related to the issue of operations going beyond the buffer in memory when input data is not properly cleared. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

Parse Server 安全漏洞

Parse Server is a backend that can be deployed to any infrastructure that can run Node.js. A denial-of-service vulnerability exists in Parse Server, which stems from certain types of invalid file requests not being handled properly and can be exploited by an attacker to cause the server to crash...

plist.js 安全漏洞

plist.js is a Mac OS X Plist parser/builder for Node.js and browsers. A security vulnerability exists in versions of plist.js prior to v3.0.4, which can be exploited by attackers to cause a denial of service DoS and possibly execute remote code...

nodejs 信任管理问题漏洞

nodejs is a JavaScript runtime environment based on the ChromeV8 engine that makes it possible to develop high-performance backend applications using Javascript by wrapping the Chromev8 engine and using event-driven and non-blocking IO applications. nodejs is vulnerable to trust management issues...

soketi 安全漏洞

soketi is a C application ported to Node.js. soketi suffers from a denial of service vulnerability that stems from not properly handling incoming error messages, which can be exploited by attackers to cause a denial of service in the application...

[SECURITY] Fedora 33 Update: nodejs-14.18.1-1.fc33

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

[SECURITY] Fedora 34 Update: nodejs-14.16.0-1.fc34

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

[SECURITY] Fedora 33 Update: nodejs-14.15.4-1.fc33

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

Arbitrary Code Execution

chromium is vulnerable to arbitrary code execution. Sharing of objects over calls into JavaScript runtime in allows a remote attacker to potentially exploit heap corruption via a malicious PDF file...

[SECURITY] Fedora 32 Update: nodejs-12.19.0-1.fc32

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...