GHSA-JQFH-8HW5-FQJR Improper Handling of Exceptional Conditions in detect-character-encoding

Impact In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. Patches The problem has been patched in detect-character-encoding v0.7.0. CVSS score CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C Base Score: 7.5 High Temporal Score: 7....

Node.js before 16.6.0 14.17.4 and 12.22.4 is vulnerable to Remote Code Execution XSS Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

...

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter no error was returned and connections to servers with an expired certificate would have been accepted.

...

SUSE SLES12 Security Update : nodejs10 (SUSE-SU-2021:2823-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2823-1 advisory. - CVE-2021-3672: Fixed missing input validation on hostnames bsc1188881. - CVE-2021-22930: Fixed use after free on close http2 on stream...

Node.js uv__idna_toascii() Heap Buffer Overflow DoS

The vulnerability of the uvidnatoascii function on the Node.js platform is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information or cause service failures...

CVE-2021-39157

detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in detect-character-encoding v0.7.0. No workaround are available and all...

CVE-2021-39157

detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in detect-character-encoding v0.7.0. No workaround are available and all...

Design/Logic Flaw

detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in detect-character-encoding v0.7.0. No workaround are available and all...

CVE-2021-39157

The CVE-2021-39157 entry relates to detect-character-encoding, a library where data matching with no charset in versions ≤0.6.0 can crash a Node.js process. The issue is resolved by upgrading to v0.7.0, as documented in Red Hat and GHSA advisories, with no workaround provided. Impact is a crash/d...

CVE-2021-39157 Improper Handling of Exceptional Conditions in detect-character-encoding

detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in detect-character-encoding v0.7.0. No workaround are available and all...

CVE-2021-39157

detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in detect-character-encoding v0.7.0. No workaround are available and all...

CVE-2021-39157: Improper Handling of Exceptional Conditions

detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in detect-character-encoding v0.7.0. No workaround are available and all...

PT-2021-15497

Name of the Vulnerable Software and Affected Versions pac-resolver versions prior to 5.0.0 Description This issue occurs due to unsafe PAC file handling when used with untrusted input, allowing for potential remote code execution. The pac-resolver package has over 3 million weekly downloads, and...

Improper Handling of Unexpected Data Type in ced

Impact In ced v0.1.0, passing data types other than Buffer causes the Node.js process to crash. Patches The problem has been patched in ced v1.0.0. You can upgrade from v0.1.0 without any breaking changes. Workarounds Before passing an argument to ced, verify it’s a Buffer using Buffer.isBufferob...

GHSA-27WQ-QX3Q-FXM9 Improper Handling of Unexpected Data Type in ced

Impact In ced v0.1.0, passing data types other than Buffer causes the Node.js process to crash. Patches The problem has been patched in ced v1.0.0. You can upgrade from v0.1.0 without any breaking changes. Workarounds Before passing an argument to ced, verify it’s a Buffer using Buffer.isBufferob...

CVE-2021-23425

A flaw was found in nodejs-trim-off-newlines. All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service ReDoS via string processing. The highest threat from this vulnerability is to system availability...

Design/Logic Flaw

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to signup users and also allow users to login anonymously. Prior to version 4.5.1, when an anonymous user is first signed up using REST, the server creates sessi...

Security Bulletin: Update Secure Gateway Client in IBM DataPower Gateway to address several CVEs

Summary Update the version of Node used by Secure Gateway Client component to address the listed CVEs. This issue affects only users of the Secure Gateway Client. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer...

Node.js 12.x, 14.x, 16.x Multiple Vulnerabilities (Aug 2021) - Mac OS X

Node.js is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Node.js 12.x, 14.x, 16.x Multiple Vulnerabilities (Aug 2021) - Windows

Node.js is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nodejs:node.js"; ifdescription...