Red Hat Security AdvisoryRHSA-2023:0321
nodejs and nodejs-nodemon security, bug fix, and enhancement update
Released 2023-01-23 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.18.1-3.el9_1, nodejs-docs-1:16.18.1-3.el9_1, nodejs-full-i18n-1:16.18.1-3.el9_1 +3
Fixes 4 records
Priority HIGH 68
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.02764 · Published 2022-12-05 · Fixed in 14.20.1, 16.17.1 +1 CWE-444
Priority MEDIUM 56
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04581 · Published 2022-03-17 · Partial fix · 1.2.6, 0.2.4 CWE-1321
Priority MEDIUM 53
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.14839 · Published 2022-12-05 · Fixed in 14.21.1, 16.18.1 +2 CWE-78
Priority MEDIUM 43
A vulnerability was found in the minimatch package.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02279 · Published 2022-10-17 · Partial fix · 3.0.5 CWE-400
THREATIST.IORead the docs