CVE-2018-7164

CVE-2018-7164 affects Node.js 9.7.0+ and 10.x. The issue is a memory-exhaustion vulnerability introduced when reading from the network into JavaScript via the net.Socket object used as a stream, enabling a denial of service by sending tiny chunks in rapid succession. The behavior was reverted to ...

CVE-2018-7162

All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service DoS by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshak...

CVE-2018-7167

Calling Buffer.fill or Buffer.alloc with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc and Buffer.fill were updated so that they zero fill instead of hanging in these cases. All versions of...

CVE-2018-7164

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by...

PT-2018-17922 · Node.Js +2 · Node.Js +2

Name of the Vulnerable Software and Affected Versions: Node.js versions 8.x through 10.x Description: The issue allows an attacker to cause a denial of service DoS by crashing a node server that provides an http2 server. This is achieved by interacting with the http2 server in a way that triggers...

PT-2018-17924 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js versions 9.7.0 and later Node.js versions 10.x Description: A bug in Node.js increases memory consumption when reading from the network into JavaScript using the net.Socket object directly as a stream. This can be exploited by an...

PT-2018-17926 · Node.Js +3 · Node.Js +3

Name of the Vulnerable Software and Affected Versions: Node.js versions 6.x through 9.x Description: The issue arises when calling Buffer.fill or Buffer.alloc with certain parameters, leading to a hang and potentially resulting in a Denial of Service. The implementations of Buffer.alloc and...

June 2018 Security Releases

June 2018 Security Releases Update 12-June-2018 Security releases available Summary Updates are now available for all active Node.js release lines. These include the fix for the vulnerabilities identified in the initial announcement below. We recommend that all users upgrade as soon as possible...

@websdk/servera (>=0.0.0, <=0.0.1-mvp.0), browser-run (>=2.6.2, <=3.0.5) +7 more potentially affected by CVE-2015-9242 via ecstatic (>=1.1.0, <=1.3.1)

ecstatic NPM version =1.1.0, =0.0.0, =2.6.2, =0.1.1, =0.1.0, =0.1.0, =0.8.5, =0.8.6 - tape-run 1.1.0 - wqst 1.0.3 Source cves: CVE-2015-9242 Source advisory: OSV:GHSA-VWJC-Q9PX-R9VQ...

CVE-2017-16184

scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16098

charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTPMAXHEADERSIZE= option the default header max length is 80kb, so the impact of the ReDoS is...

Directory traversal

scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

CVE-2017-16072

CVE-2017-16072 concerns the nodemailer.js package, which is identified as malware that steals environment variables. The npm package was published with malicious intent and has since been unpublished from the npm registry. Connected advisories and records describe the malware behavior and recomme...

CVE-2018-3717

The CVE-2018-3717 entry concerns the connect Node.js middleware, where a Cross-Site Scripting (XSS) vulnerability exists due to lack of validation of files in the directory.js middleware. Affected versions are prior to 2.14.0. The underlying issue is inadequate input validation in directory.js, e...

CVE-2017-16083

node-simple-router is a minimalistic router for Node. node-simple-router is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL...

CVE-2017-16184

Summary (CVE-2017-16184): The issue affects the Node.js/Express-based sample app scott-blanch-weather-app , where a directory traversal vulnerability exists in path handling that allows access to the filesystem by using sequences like '../../..'. The root cause is improper handling of user-suppli...

CVE-2017-16184

scott-blanch-weather-app is a sample Node.js app using Express 4. scott-blanch-weather-app is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

jadedown denial of service vulnerability

jadedown is a package used in Ndoe.js. A security vulnerability exists in jadedown. An attacker can exploit this vulnerability by passing in certain types of user input to cause a denial of service...

Node.js third-party modules: XSS in express-useragent through HTTP User-Agent

Hello, I would like to report an XSS in express-useragent module due a lack of validating User-Agent header. Please note I already created an Github issue and asked for CVE CVE-2018-9863. I did not know about Node.js third-party modules on hackerone. Description express-useragent is simple...

Node.js third-party modules: Arbitrary File Write through archive extraction

I would like to report arbitrary file write vulnerability in adm-zip module It allows attackers to write arbitrary files when a malicious archive is extracted. More info here: https://snyk.io/research/zip-slip-vulnerability https://github.com/snyk/zip-slip-vulnerabilityaffected-libraries Module...