Red Hat Security AdvisoryRHSA-2022:6449
nodejs:16 security and bug fix update
Released 2022-09-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.16.0-3.module+el8.6.0+16248+76b0e185.aarch64::nodejs:16, nodejs-1:16.16.0-3.module+el8.6.0+16248+76b0e185.ppc64le::nodejs:16, nodejs-1:16.16.0-3.module+el8.6.0+16248+76b0e185.s390x::nodejs:16 +19
Fixes 6 records
Priority HIGH 69
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.81832 · Published 2022-07-14 · Fixed in 14.20.0, 16.20.0 +2 CWE-444
Priority HIGH 66
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.70244 · Published 2022-07-14 · Fixed in 14.20.1, 16.17.1 +1 CWE-444
Priority MEDIUM 58
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.44843 · Published 2022-07-14 · Fixed in 14.20.1, 16.17.1 +2 CWE-444
Priority MEDIUM 45
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP addr…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.06432 · Published 2022-07-14 · Fixed in 14.20.1, 16.17.1 +1 CWE-284
Priority MEDIUM 45
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03552 · Published 2021-09-17 · Partial fix · 6.0.1, 5.0.1 +2 CWE-1333
Priority LOW 29
The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02416 · Published 2022-06-18 · Partial fix · 12.1.0, 11.8.5
THREATIST.IORead the docs