`undici.request` vulnerable to SSRF using absolute URL on `pathname`

Impact undici is vulnerable to SSRF Server-side Request Forgery when an application takes in user input into the path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1 js const undici = require"undici" undici.requestorigin: "http://example.com",...

CVE-2022-35948 CRLF Injection in Nodejs ‘undici’ via Content-Type

undici is an HTTP/1.1 client, written from scratch for Node.js.= [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header. Example: import request from 'undici' const unsanitizedContentTypeInp...

DEBIAN-CVE-2022-35949

undici is an HTTP/1.1 client, written from scratch for Node.js.undici is vulnerable to SSRF Server-side Request Forgery when an application takes in user input into the path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1 js const undici =...

CVE-2022-32213 affecting package nodejs 14.18.3-1

CVE-2022-32213 affecting package nodejs 14.18.3-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-32215 affecting package nodejs 14.18.3-1

CVE-2022-32215 affecting package nodejs 14.18.3-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-32212 affecting package nodejs 14.18.3-1

CVE-2022-32212 affecting package nodejs 14.18.3-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-32214 affecting package nodejs 14.18.3-1

CVE-2022-32214 affecting package nodejs 14.18.3-1. An upgraded version of the package is available that resolves this issue...

Malicious code in quest-bee-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 554817dcee33cd9d1832a7cf89456ca2d38f2c4f6e0c454f135842c0d2473aaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5563 Malicious code in quest-bee-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 554817dcee33cd9d1832a7cf89456ca2d38f2c4f6e0c454f135842c0d2473aaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

NodeJS System Information Library Command Injection (CVE-2021-21315)

Binary data nodejscve-2021-21315.nbin...

Internet Bug Bounty: CVE-2022-35948: CRLF Injection in Nodejs ‘undici’ via Content-Type

undici library should be protects HTTP headers from CRLF injection vulnerabilities. However, CRLF injection exists in the ‘content-type’ header of undici.request api. Impact = [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more...

Malicious Package

Overview performance-quality-models-nodejs is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable...

CVE-2022-37434

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call...

GHSA-2CPX-6PQP-WF35 fs2-io skips mTLS client verification

Impact When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on Node.js. The JVM TLS implementation is completely...

CVE-2016-4991

Input passed to the Pdf function is shell escaped and passed to childprocess.exec during PDF rendering. However, the shell escape does not properly encode all special characters, namely, semicolon and curly braces. This can be abused to achieve command execution. This problem affects nodepdf 1.3....

Critical Photon OS Security Update - PHSA-2022-0426

Updates of 'nodejs' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-3.0-0426

Updates of 'nodejs' packages of Photon OS have been released...

js-ini security vulnerability

js-ini is a Node.js package for encoding/decoding ini-like strings from the Russian individual developer Denis. A security vulnerability exists in versions of js-ini prior to 1.3.0 that stems from the package's susceptibility to prototype contamination, which can be exploited by an attacker to...

Malicious code in nodejs-email (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b97dc984fb1029ce10f445896e79f414c5d13f44ed4212c2441dfd4c7aece0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Apache SkyWalking Denial of Service Vulnerability

Apache SkyWalking is an application performance monitor from the Apache Foundation that is primarily used in environments such as microservices, cloud-native and container-based. A denial of service vulnerability exists in Apache SkyWalking NodeJS Agent prior to version 0.5.1, which stems from an...