Design/Logic Flaw

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

CVE-2024-23340

The CVE concerns @hono/node-server (Node.js adapter) where its custom Request.url does not resolve ". ." (double dots), causing un-resolved paths like http://localhost/static/.. /foo.txt to be passed to serveStatic. This path-traversal can enable access to unintended files on the static server, u...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

node-server path traversal vulnerability

node-server is an adapter that allows users to run Hono applications on Node.js. A path traversal vulnerability exists in node-server version 1.3.0 through versions prior to 1.4.1, which stems from an inability to resolve double dots in a URL...

Path Traversal

web-node-server is vulnerable to Path Traversal. The vulnerability is due to to a lack of sanitization of relative file paths in the start function of nodeserver.js which allows an attacker to write arbitrary files outside the expected directory...

Malicious code in seal_online_node_server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bf0243aa25b356dbd5d2f2018019d81b39aa0ce936772bd7aa1761a1c306b85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5987 Malicious code in seal_online_node_server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bf0243aa25b356dbd5d2f2018019d81b39aa0ce936772bd7aa1761a1c306b85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-WM7H-9275-46V2 Crash in HeaderParser in dicer

This affects all versions of the package dicer. A malicious attacker can send a modified form to the server and crash the Node.js service. A complete denial of service can be achieved by sending the malicious form in a loop...

Node.js: HTTP Request Smuggling Due To Improper Delimiting of Header Fields

Summary: The llhttp parser in the http module in Node v17.8.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. Description: The LF character without CR is sufficient to delimit HTTP header fields in the lihttp parser. According to...

GHSA-273R-MGR4-V34F Uncaught Exception in engine.io

Impact A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear at Receiver.getInfo /.../nodemodules/ws/lib/receiver.js:176:14 at Receiver.startLoop...

CVE-2021-29486

cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data array of x values. In versions prior to 2.0.0 apps using this library on improper data may crash or go into an infinite-loop. In the case of a nodejs...

ts-node-server (>=1.1.0, <=2.0.0) potentially affected by CVE-2019-10746 via mixin-deep (2.0.0)

mixin-deep NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mixin-deep and may be impacted: - ts-node-server =1.1.0, =2.0.0 Source cves: CVE-2019-10746 Source advisory: OSV:GHSA-FHJF-83WG-R2J9...

ts-node-server (>=1.1.0, <=2.0.0) potentially affected by CVE-2019-10746 via mixin-deep (2.0.0)

mixin-deep NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mixin-deep and may be impacted: - ts-node-server =1.1.0, =2.0.0 Source cves: CVE-2019-10746 Source advisory: SNYK:JS-MIXINDEEP-450212...

GHSA-J38M-7Q52-FGFH Directory Traversal in node-server-forfront

Affected versions of node-server-forfront resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable syste...

Directory Traversal in node-server-forfront

Affected versions of node-server-forfront resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable syste...

node-srv path traversal vulnerability

node-srv is a static Node.js server with support for Heroku and Grunt.js. A path traversal vulnerability exists in node-srv, which stems from the program's lack of url checksums. An attacker can exploit this vulnerability to read the contents of an arbitrary file with a known path...

node-server-forfront path traversal vulnerability

node-server-forfront is a static file server. A path traversal vulnerability exists in node-server-forfront. An attacker can gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...

Directory Traversal

node-server-forfront is vulnerable to directory traversal attacks. These attacks are possible by requesting a url such as /..%2f..%2fetc/passwd to get sensitive information...

CVE-2017-16124

node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...