CVE-2018-7164

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by...

CVE-2018-7162

CVE-2018-7162 affects Node.js 9.x and 10.x where a TLS handshake with duplicate/unexpected messages can crash a node http server, causing DoS. Root cause is a TLS handling issue in vulnerable Node.js versions. The vulnerability is addressed by updating the TLS implementation. Affected software is...

PT-2018-17922 · Node.Js +2 · Node.Js +2

Name of the Vulnerable Software and Affected Versions: Node.js versions 8.x through 10.x Description: The issue allows an attacker to cause a denial of service DoS by crashing a node server that provides an http2 server. This is achieved by interacting with the http2 server in a way that triggers...

PT-2018-17924 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js versions 9.7.0 and later Node.js versions 10.x Description: A bug in Node.js increases memory consumption when reading from the network into JavaScript using the net.Socket object directly as a stream. This can be exploited by an...

PT-2018-17926 · Node.Js +3 · Node.Js +3

Name of the Vulnerable Software and Affected Versions: Node.js versions 6.x through 9.x Description: The issue arises when calling Buffer.fill or Buffer.alloc with certain parameters, leading to a hang and potentially resulting in a Denial of Service. The implementations of Buffer.alloc and...

June 2018 Security Releases

June 2018 Security Releases Update 12-June-2018 Security releases available Summary Updates are now available for all active Node.js release lines. These include the fix for the vulnerabilities identified in the initial announcement below. We recommend that all users upgrade as soon as possible...

@websdk/servera (>=0.0.0, <=0.0.1-mvp.0), browser-run (>=2.6.2, <=3.0.5) +7 more potentially affected by CVE-2015-9242 via ecstatic (>=1.1.0, <=1.3.1)

ecstatic NPM version =1.1.0, =0.0.0, =2.6.2, =0.1.1, =0.1.0, =0.1.0, =0.8.5, =0.8.6 - tape-run 1.1.0 - wqst 1.0.3 Source cves: CVE-2015-9242 Source advisory: OSV:GHSA-VWJC-Q9PX-R9VQ...

CVE-2017-16184

scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16098

charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTPMAXHEADERSIZE= option the default header max length is 80kb, so the impact of the ReDoS is...

Directory traversal

scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16072

CVE-2017-16072 concerns the nodemailer.js package, which is identified as malware that steals environment variables. The npm package was published with malicious intent and has since been unpublished from the npm registry. Connected advisories and records describe the malware behavior and recomme...

CVE-2017-16083

node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL...

CVE-2018-3717

The CVE-2018-3717 entry concerns the connect Node.js middleware, where a Cross-Site Scripting (XSS) vulnerability exists due to lack of validation of files in the directory.js middleware. Affected versions are prior to 2.14.0. The underlying issue is inadequate input validation in directory.js, e...

CVE-2017-16184

Summary (CVE-2017-16184): The issue affects the Node.js/Express-based sample app scott-blanch-weather-app , where a directory traversal vulnerability exists in path handling that allows access to the filesystem by using sequences like '../../..'. The root cause is improper handling of user-suppli...

CVE-2017-16184

scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

jadedown denial of service vulnerability

jadedown is a package used in Ndoe.js. A security vulnerability exists in jadedown. An attacker can exploit this vulnerability by passing in certain types of user input to cause a denial of service...

Node.js third-party modules: XSS in express-useragent through HTTP User-Agent

Hello, I would like to report an XSS in express-useragent module due a lack of validating User-Agent header. Please note I already created an Github issue and asked for CVE CVE-2018-9863. I did not know about Node.js third-party modules on hackerone. Description express-useragent is simple...

Node.js third-party modules: Arbitrary File Write through archive extraction

I would like to report arbitrary file write vulnerability in adm-zip module It allows attackers to write arbitrary files when a malicious archive is extracted. More info here: https://snyk.io/research/zip-slip-vulnerability https://github.com/snyk/zip-slip-vulnerabilityaffected-libraries Module...

Node.js third-party modules: Arbitrary File Write Through Archive Extraction

I would like to report arbitrary file write vulnerability in adm-zip module It allows attackers to write arbitrary files when a malicious archive is extracted. More info here: https://snyk.io/research/zip-slip-vulnerability https://github.com/snyk/zip-slip-vulnerabilityaffected-libraries Module...

CVE-2017-16019

GitBook is a command line tool and Node.js library for building beautiful books using GitHub/Git and Markdown or AsciiDoc. Stored Cross-Site-Scripting XSS is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader...