nodejs-json-schema: Prototype pollution vulnerability

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...

GHSA-CV76-RV4H-4MQC OS Command Injection in proctree

OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function...

Vulnerability of the API component: A software platform in Node.js that allows attackers to compromise data integrity

The vulnerability of the API component in the Node.js software platform is related to insufficient checking of the rejectUnauthorized value. Exploiting this vulnerability allows an attacker to compromise data integrity...

The vulnerability of the Node.js software platform’s DNS library, related to insufficient input validation, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Node.js software platform’s DNS library is related to the improper handling of atypical symbols in domain names. Exploiting this vulnerability allows an attacker who operates remotely to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the implementation of the method for specifying all domain names and IP addresses in the Node.js software platform allows attackers to perform spoofing attacks.

The vulnerability of the method for specifying all domain names and IP addresses on the Node.js software platform is related to errors in the X.509 certificate validation process. Exploiting this vulnerability allows a malicious actor to perform spoofing attacks remotely...

The vulnerability of the console.table() function implementation in Node.js’s software platform allows attackers to trigger a service failure or bypass security restrictions.

The vulnerability of the console.table function implementation in Node.js.js platforms is related to insufficient control over dynamically defined object properties. Exploiting this vulnerability could allow a malicious actor to trigger service failures or circumvent security restrictions by...

nodejs-normalize-url: ReDoS for data URLs

A flaw was found in normalize-url. Node.js has a ReDoS regular expression denial of service issue because it has exponential performance for data...

OESA-2021-1291 nodejs security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

The vulnerability of the Node.js software platform’s module moment allows a hacker to trigger a service failure.

The vulnerability of Node.js’s runtime module is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of the Node.js software platform is related to an error in handling HTTP headers, which allows attackers to trigger a service failure.

The vulnerability of the Node.js software platform is related to an error in handling HTTP header names. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Fedora: Security Advisory for libuv (FEDORA-2020-bc0050aa3d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulnerability of the functions napi_get_value_string_latin1(), napi_get_value_string_utf8(), and napi_get_value_string_utf16 on the Node.js software platform, allowing a hacker to execute arbitrary code.

The vulnerabilities of the functions napigetvaluestringlatin1, napigetvaluestringutf8, and napigetvaluestringutf16 in the Node.js software platform are related to the execution of operations outside of the buffer in memory. Exploiting these vulnerabilities can allow a remote attacker to execute...

The vulnerability of the `connection.c` component of the HTTP/2 web server Apache Traffic Server, the H2O web server, Node.js software platform, and the SwiftNIO networking framework allows a attacker to cause a service failure.

The vulnerability of the connection.c component of the HTTP/2 web server Apache Traffic Server, the H2O web server, the Node.js software platform, and the SwiftNIO networking framework is related to errors in the resource consumption control mechanism. Exploiting this vulnerability can allow an...

The vulnerability relates to the implementation of the HTTP/2 network protocol on Windows operating systems, Apache Traffic Server web servers, network software such as Envoy, and Node.js software platforms. This allows attackers to induce service interruptions.

The vulnerability of the HTTP/2 network protocol implementation in Windows operating systems, Apache Traffic Server web servers, networking software like Envoy, and Node.js software platforms is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious...

nodejs: HTTP request splitting

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the path option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to...

GHSA-G6F4-J6C2-W3P3 High severity vulnerability that affects uglify-js

Withdrawn, accidental duplicate publish. The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperl...

UBUNTU-CVE-2013-7453

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting XSS filter via vectors related to UI redressing...