141 matches found
GHSA-WM7H-9275-46V2 Crash in HeaderParser in dicer
This affects all versions of the package dicer. A malicious attacker can send a modified form to the server and crash the Node.js service. A complete denial of service can be achieved by sending the malicious form in a loop...
Node.js: HTTP Request Smuggling Due To Improper Delimiting of Header Fields
Summary: The llhttp parser in the http module in Node v17.8.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. Description: The LF character without CR is sufficient to delimit HTTP header fields in the lihttp parser. According to...
GHSA-273R-MGR4-V34F Uncaught Exception in engine.io
Impact A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear at Receiver.getInfo /.../nodemodules/ws/lib/receiver.js:176:14 at Receiver.startLoop...
CVE-2021-29486
cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data array of x values. In versions prior to 2.0.0 apps using this library on improper data may crash or go into an infinite-loop. In the case of a nodejs...
ts-node-server (>=1.1.0, <=2.0.0) potentially affected by CVE-2019-10746 via mixin-deep (2.0.0)
mixin-deep NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mixin-deep and may be impacted: - ts-node-server =1.1.0, =2.0.0 Source cves: CVE-2019-10746 Source advisory: GHSA-FHJF-83WG-R2J9...
ts-node-server (>=1.1.0, <=2.0.0) potentially affected by CVE-2019-10746 via mixin-deep (2.0.0)
mixin-deep NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mixin-deep and may be impacted: - ts-node-server =1.1.0, =2.0.0 Source cves: CVE-2019-10746 Source advisory: OSV:GHSA-FHJF-83WG-R2J9...
ts-node-server (>=1.1.0, <=2.0.0) potentially affected by CVE-2019-10746 via mixin-deep (2.0.0)
mixin-deep NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mixin-deep and may be impacted: - ts-node-server =1.1.0, =2.0.0 Source cves: CVE-2019-10746 Source advisory: MEND:CVE-2019-10746...
ts-node-server (>=1.1.0, <=2.0.0) potentially affected by CVE-2019-10746 via mixin-deep (2.0.0)
mixin-deep NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mixin-deep and may be impacted: - ts-node-server =1.1.0, =2.0.0 Source cves: CVE-2019-10746 Source advisory: SNYK:JS-MIXINDEEP-450212...
Directory Traversal in node-server-forfront
Affected versions of node-server-forfront resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable syste...
GHSA-J38M-7Q52-FGFH Directory Traversal in node-server-forfront
Affected versions of node-server-forfront resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable syste...
node-srv path traversal vulnerability
node-srv is a static Node.js server with support for Heroku and Grunt.js. A path traversal vulnerability exists in node-srv, which stems from the program's lack of url checksums. An attacker can exploit this vulnerability to read the contents of an arbitrary file with a known path...
node-server-forfront path traversal vulnerability
node-server-forfront is a static file server. A path traversal vulnerability exists in node-server-forfront. An attacker can gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...
Directory Traversal
node-server-forfront is vulnerable to directory traversal attacks. These attacks are possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...
CVE-2017-16124
node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...
CVE-2017-16124
node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...
CVE-2017-16124
node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...
CVE-2017-16124: Improper Limitation of a Pathname to a Restricted Directory
node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...
PT-2018-6152
Name of the Vulnerable Software and Affected Versions: node-server-forfront versions affected versions not specified Description: The issue concerns a directory traversal problem, allowing an attacker to access the filesystem by manipulating the URL with "../". This can lead to the disclosure of...
DEBIAN-CVE-2016-10542
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier...