CVE-2021-22940

A flaw was found in Node.js, where it is vulnerable to a use-after-free attack. This flaw allows an attacker to exploit memory corruption to change process behavior. The highest threat from this vulnerability is to confidentiality and integrity...

CVE-2021-22931

A flaw was found in Node.js. These vulnerabilities include remote code execution, Cross-site scripting XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library, which can lead to the output of wrong hostnames leading to Domai...

ZEIT Next.js Input Validation Error Vulnerability (CNVD-2021-61800)

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack, and Babel.js. ZEIT Next.js is vulnerable to an input validation error in versions prior to 11.1.0, which stems from a web system or product that does not properly validate input data. An attacker...

nodejs:12 security, bug fix, and enhancement update

nodejs 1:12.22.3-2 - Resolves: RHBZ1980031, RHBZ1978201 - Fix typo, BR systemtap-sdt-level always, remove y18n patch 1:12.22.3-1 - Resolves: RHBZ1980031, RHBZ1978201 - Resolves 1952915 - Resolves CVE-2021-22918libuv, use system cipher list nodejs-nodemon 2.0.3-1 - Resolves: RHBZ1920692,...

CVE-2018-12123 affecting package nodejs 8.11.4-7

CVE-2018-12123 affecting package nodejs 8.11.4-7. An upgraded version of the package is available that resolves this issue...

RHEL 8 : nodejs:14 (RHSA-2021:3074)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3074 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

Oracle Linux 8 : nodejs:12 (ELSA-2021-3073)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3073 advisory. - Resolves CVE-2021-22918libuv, use system cipher list nodejs-nodemon Tenable has extracted the preceding description block directly from the Oracle...

Oracle Linux 8 : nodejs:14 (ELSA-2021-3074)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-3074 advisory. - Resolves CVE-2021-22918libuv, use system cipher list Tenable has extracted the preceding description block directly from the Oracle Linux security...

Oracle Linux 8 : libuv (ELSA-2021-3075)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-3075 advisory. 1:1.41.1-1 - Rebase to 1.41.1 - Change description to reflect upstream - Resolves: RHBZ1980033 Tenable has extracted the preceding description block directly fr...

August 2021 Security Releases

August 2021 Security Releases Update 11-Aug-2021 Security releases available Updates are now available for v16.x, v14.x, and v12.x Node.js release lines for the following issues. cares upgrade - Improper handling of untypical characters in domain names High CVE-2021-22931 Node.js was vulnerable t...

Node.js -- August 2021 Security Releases

Node.js reports: cares upgrade - Improper handling of untypical characters in domain names High CVE-2021-22931 Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of host names returned by Domain Name Servers in the Node.js DNS library which c...

RHEL 8 : nodejs:12 (RHSA-2021:3073)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3073 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager DR

Summary There is vulnerability in npm which affects IBM VM Recovery Manager DR Vulnerability Details Third Party Entry: 184667 DESCRIPTION: Node.js npm-registry-fetch module could allow a remote attacker to obtain sensitive information, caused by the storing of user credentials in the log file. B...

nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode

A flaw was found in ssri package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service ReDoS. This issue only affects consumers using the strict option. The highest threat from this vulnerability is to availability...

Moderate: Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: nodejs:12 security, bug fix, and enhancement update

An update for the nodejs:12 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes

A flaw has been found in libuv. Node.js is vulnerable to out-of-bounds read in libuv's uvidnatoascii function which is used to convert strings to ASCII which is called by Node's DNS module's lookup function and can lead to information disclosures or crashes. The highest threat from this...

nodejs:14 security, bug fix, and enhancement update

An update is available for nodejs-nodemon, nodejs, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform f...

ALSA-2021:3074 Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 14.17.3. BZ1978203 Security Fixes: nodejs-hosted-git-info: Regular Expression denial...

Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 14.17.3. BZ1978203 Security Fixes: nodejs-hosted-git-info: Regular Expression denial...