Node.js security vulnerabilities

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js versions 18.x, 20.x, and 21.x. The vulnerability stems from the fact that an attacker can make the server completely unavailable by sending a small number of HTTP/2 framed packets...

nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks

A flaw was found in Node.js due to a lack of safeguards on chunk extension bytes. The server may read an unbounded number of bytes from a single connection, which can allow an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and a denial of...

nodejs: setuid() does not drop all privileges due to io_uring

A flaw was found in Node.js, where the setuid does not affect libuv's internal iouring operations if initialized before the call to setuid. This issue allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid...

nodejs: code injection and privilege escalation through Linux capabilities

A flaw was found in Node.js. On Linux, Node.js ignores certain environment variables if an unprivileged user has set them while the process is running with elevated privileges, except for CAPNETBINDSERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this...

node::http2::Http2Session::~Http2Session() DoS

The vulnerability of the node::http2::Http2Session::Http2Session function in HTTP/2 server-side software for Node.js is related to an uncontrolled resource consumption due to incorrect handling of header termination when processing CONTINUATION frames. Exploiting this vulnerability can allow a...

PT-2024-2956

Name of the Vulnerable Software and Affected Versions Undici versions prior to 5.28.4 Undici versions prior to 6.11.1 Description The issue is related to insufficient access control in the Undici HTTP/1.1 client for Node.js, allowing a remote attacker to execute arbitrary code by altering the...

node-ip Code Execution

The vulnerability of the node-ip utility in the Node.js software platform is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

excalidraw XSS

The vulnerability of the excalidraw package on the Node.js software platform is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using a specially created link...

nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks

A flaw was found in Node.js due to a lack of safeguards on chunk extension bytes. The server may read an unbounded number of bytes from a single connection, which can allow an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and a denial of...

DEBIAN-CVE-2024-22025

A vulnerability in Node.js has been identified, allowing for a Denial of Service DoS attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch function in Node.js always decodes Brotli, making i...

Node.js Security Vulnerabilities

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js versions 18.18.x, 20.4.x, and 21.x, which stems from the fact that setuid does not relinquish all privileges as a result of iouring, allowing the process to perform privileged...

Node.js follow-redirects URL Parsing Phishing

The vulnerability of the url.parse function in the Node.js follow-redirects module is related to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a remote attacker to carry out phishing attacks...

jsonpointer package Node.js Code Execution

The vulnerability of the jsonpointer package in the Node.js software platform is related to errors in data type conversion. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Node.js Code Execution

The vulnerability of the Node.js software platform is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with elevated privileges during exception handling for the CAPNETBINDSERVICE privilege...

OESA-2024-1169 nodejs security update

Node.js is an open-source, cross-platform, JavaScript runtime environment, it executes JavaScript code outside of a browser. Security Fixes: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the...

is-my-json-valid Library DoS

The vulnerability of the Node.js software library “is-my-json-valid” relates to an inefficient regular expression used for checking JSON fields. This allows a malicious actor, operating remotely, to cause a service failure by sending a specially crafted JSON file...

SUSE CVE-2023-46809

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/hkario/marvin/, if PCKS 1 v1.5 padding is allowed when performing RSA descryption using a privat...

SUSE CVE-2024-22019

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service DoS. The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk...

sshpk library Node.js DoS

The vulnerability of the sshpk library on the Node.js software platform is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Node.js child_process.exec Command Execution

The vulnerability of the childprocess.exec function in the cross-platform networking library of Node.js exists due to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...