Read the docs
Red Hat Security Advisory

RHSA-2018:2949

rh-nodejs8-nodejs security update

Released 2018-10-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 5 records

TI-2018-05185 CVE-2018-7160

Authentication bypass by spoofing in NodeJS Node.js

Priority MEDIUM 52

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.09493 Published 2018-05-17 Partial fix CWE-350
TI-2018-05186 CVE-2018-7161 · GHSA-jfr7-p3h5-mh28

Improper input validation in NodeJS Node.js

Priority MEDIUM 49

All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.07485 Published 2018-06-13 Fixed CWE-20
TI-2018-05190 CVE-2018-7167 · GHSA-jr5v-587f-389p

Memory corruption in NodeJS Node.js

Priority MEDIUM 48

Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06689 Published 2018-06-13 Partial fix CWE-119
TI-2018-08691 CVE-2018-12115 · GHSA-q85m-543x-pwpc

Out-of-bounds write in NodeJS Node.js

Priority MEDIUM 43

In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to wri…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.07779 Published 2018-08-21 Partial fix CWE-787
TI-2018-05184 CVE-2018-7159 · GHSA-87vg-5pwm-8x6w

Improper input validation in NodeJS Node.js

Priority LOW 36

The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03542 Published 2018-05-17 Partial fix CWE-115