Red Hat Security AdvisoryRHSA-2024:2910
nodejs security update
Released 2024-05-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.20.2-8.el9_4, nodejs-docs-1:16.20.2-8.el9_4, nodejs-full-i18n-1:16.20.2-8.el9_4 +2
Fixes 5 records
Priority HIGH 84
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside.
CVSS 3.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.87211 · Published 2024-04-09 · Partial fix · 18.20.1, 20.12.1 +1 CWE-362
Priority HIGH 71
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.81994 · Published 2024-04-04 · Partial fix · 1.61.0 CWE-770
Priority LOW 37
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling.
CVSS 3.0MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01155 · Published 2024-05-07 · Partial fix · 18.20.1, 20.12.1 +1 CWE-444
Priority LOW 31
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01309 · Published 2024-03-19 · Partial fix · 18.19.1, 20.11.1 +1 CWE-404
Priority LOW 25
c-ares is a C library for asynchronous DNS requests.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00352 · Published 2024-02-23 · Partial fix · 1.27.0 CWE-127
THREATIST.IORead the docs