BIT-NODE-MIN-2024-22019

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service DoS. The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk...

BIT-NODE-MIN-2024-22020

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports...

BIT-NODE-MIN-2024-22025

A vulnerability in Node.js has been identified, allowing for a Denial of Service DoS attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch function in Node.js always decodes Brotli, making i...

BIT-NODE-MIN-2024-27983

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a T...

BIT-NODE-MIN-2024-36137

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to...

CVE-2024-12641

The CVE-2024-12641 entry describes TenderDocTransfer by Chunghwa Telecom as vulnerable to Reflected Cross-site Scripting due to missing CSRF protection on API endpoints. Unauthenticated remote attackers could use specific APIs via phishing to inject and execute arbitrary JavaScript in a user’s br...

CVE-2024-12641 Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE

TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use...

CVE-2024-12641 Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE

TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use...

CVE-2024-12641: Improper Neutralization of Input During Web Page Generation

TenderDocTransfer from Chunghwa Telecom has a Reflected Cross-site scripting vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use...

PT-2024-17685

Name of the Vulnerable Software and Affected Versions TenderDocTransfer from Chunghwa Telecom affected versions not specified Description The application has a Reflected Cross-site scripting vulnerability. It sets up a simple local web server and provides APIs for communication with the target...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js.

Summary Multiple vulnerabilities in Node.js that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2024-27980 DESCRIPTION: Node.js could allow a remote attacker to execute arbitrary commands on the system, caused by the improper handling of batch files in...

Security Bulletin: Platform UI and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Node.js vulnerability 351136

Summary Platform UI and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service due to Node.js vulnerability 351136 with details below. The vulnerabilities have been addressed. Vulnerability Details IBM X-Force ID: 351136 DESCRIPTION: Node.js npm inflight module is...

SUSE SLES15 / openSUSE 15 Security Update : nodejs20 (SUSE-SU-2024:4300-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4300-1 advisory. - CVE-2024-21538: Fixed regular expression denial of service in cross-spawn dependency bsc1233856 Other fixes: - Updated to...

SUSE SLES15 / openSUSE 15 Security Update : nodejs20 (SUSE-SU-2024:4286-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:4286-1 advisory. - CVE-2024-21538: Fixed regular expression denial of service in cross-spawn dependency bsc1233856 Other fixes: - Updated to...

SUSE-SU-2024:4286-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: - CVE-2024-21538: Fixed regular expression denial of service in cross-spawn dependency bsc1233856 Other fixes: - Updated to 20.18.1: Experimental Network Inspection Support in Node.js Exposes X509VFLAGPARTIALCHAIN to tls.createSecureContext New...

Amazon Linux 2022 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2022-2022-019)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-019 advisory. A flaw was found in node.js where it accepted a certificate's Subject Alternative Names SAN entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active...

Amazon Linux 2022 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2022-2022-013)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-013 advisory. An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. Spaces as part of the header names were accepted as valid. In situations where HTTP conversations a...

@directus/api (>=18.0.0, <=21.0.1) potentially affected by CVE-2024-54128 via directus (>=10.10.0, <=10.13.2)

directus NPM version =10.10.0, =18.0.0, =21.0.1 Source cves: CVE-2024-54128 Source advisory: OSV:GHSA-R6WX-627V-GH2F...

@intlify/shared Prototype Pollution vulnerability

Vulnerability type: Prototype Pollution Affected Package: Product: @intlify/shared Version: 10.0.4 Vulnerability Locations: nodemodules/@intlify/shared/dist/shared.cjs:232:26 Description: The latest version of @intlify/shared 10.0.4 is vulnerable to Prototype Pollution through the entry functions...

CVE-2024-52810 Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4

@intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared 10.0.4 is vulnerable to Prototype Pollution through the entry functions lib.deepCopy. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the globa...