TI-2023-09734 CVE-2023-23936 · GHSA-5r9g-qh6m-jxff
CRLF Injection in Nodejs ‘undici’ via host
Priority HIGH 68
Undici is an HTTP/1.1 client for Node.js.
RHSA-2023:2655
nodejs and nodejs-nodemon security, bug fix, and enhancement update
Released 2023-05-09 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.19.1-1.el9_2, nodejs-docs-1:16.19.1-1.el9_2, nodejs-full-i18n-1:16.19.1-1.el9_2 +3
Fixes 7 records
TI-2022-09440 CVE-2022-25881 · GHSA-rc47-6667-2j5j
Regular expression denial of service in http-cache-semantics
Priority HIGH 68
This affects versions of the package http-cache-semantics before 4.1.1.
TI-2021-14025 CVE-2021-35065 · GHSA-cj88-88mr-972w
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial…
Priority HIGH 66
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
TI-2022-04495 CVE-2022-4904 · GHSA-v7h6-g695-5j7q
Improper input validation in c-ares
Priority MEDIUM 46
A flaw was found in the c-ares package.
TI-2023-09716 CVE-2023-23918 · GHSA-33p5-m25c-cp6w
Incorrect authorization in NodeJS Node
Priority MEDIUM 43
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js an…
TI-2023-10307 CVE-2023-24807 · GHSA-r6ch-mqf9-qc9w
Undici vulnerable to Regular Expression Denial of Service in Headers
Priority MEDIUM 42
Undici is an HTTP/1.1 client for Node.js.
TI-2023-09718 CVE-2023-23920 · GHSA-fj8r-46q3-hp4r
Untrusted search path in NodeJS Node
Priority LOW 20
An untrusted search path vulnerability exists in Node.js.