ALPINE-CVE-2023-32006

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

CVE-2023-32004 vulnerabilities

Vulnerabilities for packages: nodejs...

DEBIAN-CVE-2023-32006

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

AZL-27941 CVE-2023-32006 affecting package nodejs for versions less than 16.20.2-2

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

CVE-2023-32004 vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2023-32006 vulnerabilities

Vulnerabilities for packages: nodejs...

AZL-27926 CVE-2023-32006 affecting package nodejs18 for versions less than 18.17.1-2

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

CVE-2023-32006 vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2023-32003 vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2023-32003 vulnerabilities

Vulnerabilities for packages: nodejs...

SUSE CVE-2023-32003

fs.mkdtemp and fs.mkdtempSync can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp API and the impact is a malicious actor could create an arbitrary directory. This vulnerability affects all users using the...

SUSE CVE-2023-32559

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding'spawnsyn...

CVE-2023-32558

A vulnerability was found in NodeJS. This security issue occurs as the use of the deprecated API process.binding can bypass the permission model through path traversal. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product...

CVE-2023-32004

A vulnerability was found in NodeJS. This security issue occurs as improper handling of buffers in file system APIs, causing a traversal path to bypass when verifying file permissions. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the R...

CVE-2023-32003

A vulnerability was found in NodeJS. This security issue occurs as fs.mkdtemp and fs.mkdtempSync can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp API, and the impact is a malicious actor could create an arbitra...

Malicious code in wasabi-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1a47529c7afca95337513fc02161d3429f5b5e4fa1ff3f80484688148b152ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1076 Malicious code in wasabi-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1a47529c7afca95337513fc02161d3429f5b5e4fa1ff3f80484688148b152ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Node.js Security Vulnerabilities

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js version 20, which stems from a vulnerability that allows an attacker to retrieve statistical information from restricted files using fs.statfs...

Important: nodejs

Issue Overview: Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range. CVE-2022-25883 Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2...

AlmaLinux 8 : nodejs:18 (ALSA-2023:4536)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:4536 advisory. nodejs: mainModule.proto bypass experimental policy mechanism CVE-2023-30581 nodejs: process interuption due to invalid Public Key information in x509...