4749 matches found
Memory Leak
inflight is vulnerable to a Memory Leak. The vulnerability is due to lack of restrictions on how many callbacks the library can concurrently support, which can result in a NodeJS out of heap memory crash...
PT-2023-3541
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.10.0 Description vm2 is an advanced sandbox for Node.js. A flaw in the sanitization of the Promise handler allows the @@species accessor property to be bypassed. This enables attackers who already have arbitrary code...
Critical Photon OS Security Update - PHSA-2023-3.0-0606
Updates of 'linux-aws', 'kube-bench', 'nginx-ingress', 'linux', 'nodejs', 'linux-secure', 'linux-esx', 'linux-rt', 'nxtgn-openssl', 'ntp' packages of Photon OS have been released...
GHSA-72XF-G2V4-QVF3 vulnerabilities
Vulnerabilities for packages: py3-captum, kubeflow-katib...
CVE-2023-26136 vulnerabilities
Vulnerabilities for packages: py3-captum, kubeflow-katib...
GHSA-CGGH-PQ45-6H9X vulnerabilities
Vulnerabilities for packages: nodejs...
AZL-27279 CVE-2023-30589 affecting package nodejs18 for versions less than 18.17.1-2
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS. The CR character without LF is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only th...
CVE-2023-30589 vulnerabilities
Vulnerabilities for packages: nodejs...
CVE-2023-30586 vulnerabilities
Vulnerabilities for packages: nodejs...
CVE-2023-30586 vulnerabilities
Vulnerabilities for packages: nodejs...
CVE-2023-30589 vulnerabilities
Vulnerabilities for packages: nodejs...
Node.js 安全漏洞
Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js that stems from loading an arbitrary OpenSSL engine when enabling an experimental privilege model, which can bypass and/or disable the privilege model...
Critical Photon OS Security Update - PHSA-2023-4.0-0417
Updates of 'protobuf', 'docker-compose', 'samba-client', 'kube-bench', 'nodejs', 'bindutils', 'libarchive', 'binutils', 'binutils-aarch64-linux-gnu', 'ntp', 'libtiff', 'libXi' packages of Photon OS have been released...
Important Photon OS Security Update - PHSA-2023-5.0-0041
Updates of 'dnsmasq', 'nodejs', 'telegraf', 'openssl' packages of Photon OS have been released...
SUSE-SU-2023:2663-1 Security update for nodejs16
This update for nodejs16 fixes the following issues: Update to version 16.20.1: - CVE-2023-30581: Fixed mainModule.proto Bypass Experimental Policy Mechanism bsc1212574. - CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process...
SUSE-SU-2023:2662-1 Security update for nodejs18
This update for nodejs18 fixes the following issues: Update to version 18.16.1: - CVE-2023-30581: Fixed mainModule.proto Bypass Experimental Policy Mechanism bsc1212574. - CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process...
Internet Bug Bounty: DiffieHellman doesn't generate keys after setting a key
A security vulnerability was discovered in the DiffieHellman module of Node.js. The module did not generate new keys after setting a private key, potentially leading to the reuse of nonces and compromising security measures such as forward secrecy and IND-CPA...
nodejs:18 security update
An update is available for module.nodejs-packaging, nodejs-packaging. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform...
Vulnerabilities fixed in Node.js
Vulnerabilities have been fixed in Node.js. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: Denial-of-Service DoS. Manipulation of data Circumvention of security measure Increased user privileges Node.js has released updates...