Red Hat Security AdvisoryRHSA-2022:6595
nodejs and nodejs-nodemon security and bug fix update
Released 2022-09-20 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.16.0-1.el9_0, nodejs-docs-1:16.16.0-1.el9_0, nodejs-full-i18n-1:16.16.0-1.el9_0 +3
Fixes 10 records
Priority HIGH 69
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.81832 · Published 2022-07-14 · Fixed in 14.20.0, 16.20.0 +2 CWE-444
Priority HIGH 66
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.70244 · Published 2022-07-14 · Fixed in 14.20.1, 16.17.1 +1 CWE-444
Priority MEDIUM 58
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.44843 · Published 2022-07-14 · Fixed in 14.20.1, 16.17.1 +2 CWE-444
Priority MEDIUM 55
This affects the package ini before 1.3.6.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03655 · Published 2020-12-11 · Partial fix · 1.3.6 CWE-1321
Priority MEDIUM 46
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04004 · Published 2022-06-13 · Partial fix · 8.11.0 CWE-200
Priority MEDIUM 45
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP addr…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.06432 · Published 2022-07-14 · Fixed in 14.20.1, 16.17.1 +1 CWE-284
Priority MEDIUM 45
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03552 · Published 2021-09-17 · Partial fix · 6.0.1, 5.0.1 +2 CWE-1333
Priority MEDIUM 40
This affects the package glob-parent before 5.1.2.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04579 · Published 2021-06-03 · Partial fix · 5.1.2 CWE-400
Priority LOW 36
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01705 · Published 2021-05-24 · Partial fix · 4.5.1, 5.3.1 +1 CWE-1333
Priority LOW 29
The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02416 · Published 2022-06-18 · Partial fix · 12.1.0, 11.8.5
THREATIST.IORead the docs