Red Hat Security Advisory

RHSA-2024:3545

nodejs security update

Released 2024-06-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.9.0) nodejs-1:16.20.2-6.el9_0, nodejs-docs-1:16.20.2-6.el9_0, nodejs-full-i18n-1:16.20.2-6.el9_0 +2

Fixes 2 records

TI-2024-18584 CVE-2024-27983 · GHSA-j65r-8hrg-qc6x

Race condition in NodeJS Node

HIGH 84

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside.

CVSS 3.0HIGH 8.2 Network No auth No interaction EPSS 0.87211 Published 2024-04-09 Partial fix · 18.20.1, 20.12.1 +1 CWE-362

TI-2024-18583 CVE-2024-27982 · GHSA-hg6j-8h7m-3w3j

The team has identified a critical vulnerability in the http server of the most recent…

LOW 37

The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling.

CVSS 3.0MEDIUM 6.5 Network No auth No interaction EPSS 0.01155 Published 2024-05-07 Partial fix · 18.20.1, 20.12.1 +1 CWE-444