TI-2023-09734 CVE-2023-23936 · GHSA-5r9g-qh6m-jxff
CRLF Injection in Nodejs ‘undici’ via host
Priority HIGH 68
Undici is an HTTP/1.1 client for Node.js.
RHSA-2023:5533
nodejs security, bug fix, and enhancement update
Released 2023-10-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v.9.0) nodejs-1:16.20.2-1.el9_0, nodejs-docs-1:16.20.2-1.el9_0, nodejs-full-i18n-1:16.20.2-1.el9_0 +2
Fixes 12 records
TI-2022-09440 CVE-2022-25881 · GHSA-rc47-6667-2j5j
Regular expression denial of service in http-cache-semantics
Priority HIGH 68
This affects versions of the package http-cache-semantics before 4.1.1.
TI-2023-15309 CVE-2023-32002 · GHSA-9m48-r3w4-x35v
Authentication bypass in NodeJS Node
Priority MEDIUM 52
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
TI-2022-04495 CVE-2022-4904 · GHSA-v7h6-g695-5j7q
Improper input validation in c-ares
Priority MEDIUM 46
A flaw was found in the c-ares package.
TI-2023-14414 CVE-2023-30589 · GHSA-cggh-pq45-6h9x
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF…
Priority MEDIUM 45
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests.
TI-2023-15313 CVE-2023-32006 · GHSA-356r-x8g9-vh8c
Protection mechanism failure in NodeJS Node
Priority MEDIUM 43
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
TI-2023-14415 CVE-2023-30590 · GHSA-v63h-9gvh-2x49
The generateKeys() API function returned from crypto.createDiffieHellman() only generates…
Priority MEDIUM 42
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to…
TI-2023-10307 CVE-2023-24807 · GHSA-r6ch-mqf9-qc9w
Undici vulnerable to Regular Expression Denial of Service in Headers
Priority MEDIUM 42
Undici is an HTTP/1.1 client for Node.js.
TI-2023-14406 CVE-2023-30581 · GHSA-86v4-9wq7-fx97
Missing authorization in NodeJS Node
Priority MEDIUM 41
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition.
TI-2023-15841 CVE-2023-32559 · GHSA-g467-j8jp-rq97
Improper privilege management in NodeJS Node
Priority LOW 38
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
TI-2023-14413 CVE-2023-30588 · GHSA-g526-x7vj-cfv6
When an invalid public key is used to create an x509 certificate using the…
Priority LOW 26
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of…
TI-2023-09718 CVE-2023-23920 · GHSA-fj8r-46q3-hp4r
Untrusted search path in NodeJS Node
Priority LOW 20
An untrusted search path vulnerability exists in Node.js.