Red Hat Security AdvisoryRHSA-2023:1742
nodejs:14 security, bug fix, and enhancement update
Released 2023-04-12 · Red Hat rating Important · View on Red Hat →
Fixes 16 records
Priority HIGH 72
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.15695 · Published 2022-11-26 · Partial fix · 6.10.3, 6.9.7 +7 CWE-1321
Priority HIGH 68
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.02764 · Published 2022-12-05 · Fixed in 14.20.1, 16.17.1 +1 CWE-444
Priority HIGH 68
This affects versions of the package http-cache-semantics before 4.1.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01613 · Published 2023-01-31 · Partial fix · 4.1.1 CWE-1333
Priority HIGH 66
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.2361 · Published 2022-11-28 · Partial fix · 0.2.1 CWE-20
Priority HIGH 66
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01696 · Published 2022-12-26 · Partial fix · 6.0.1 CWE-1333
Priority MEDIUM 56
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04581 · Published 2022-03-17 · Partial fix · 1.2.6, 0.2.4 CWE-1321
Priority MEDIUM 55
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one proper…
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.21514 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-471
Priority MEDIUM 53
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.14839 · Published 2022-12-05 · Fixed in 14.21.1, 16.18.1 +2 CWE-78
Priority MEDIUM 46
A flaw was found in the c-ares package.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.01232 · Published 2023-03-06 · Partial fix CWE-20
Priority MEDIUM 43
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js an…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02023 · Published 2023-02-23 · Partial fix · 14.21.3, 16.19.1 +2 CWE-863
Priority MEDIUM 43
A vulnerability was found in the minimatch package.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02279 · Published 2022-10-17 · Partial fix · 3.0.5 CWE-400
Priority MEDIUM 43
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.08373 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-295
Priority MEDIUM 42
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.09358 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-295
Priority LOW 37
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.10364 · Published 2022-02-24 · Partial fix · 12.22.9, 14.18.3 +2 CWE-296
Priority LOW 31
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01653 · Published 2022-01-16 · Partial fix · 3.1.1, 2.6.7 CWE-200
Priority LOW 20
An untrusted search path vulnerability exists in Node.js.
CVSS 3.1MEDIUM 4.2· Local · High privileges · User interaction · EPSS 0.00452 · Published 2023-02-23 · Partial fix · 14.21.3, 16.19.1 +2 CWE-426
THREATIST.IORead the docs