Red Hat Security AdvisoryRHSA-2024:4559
nodejs security update
Released 2024-07-16 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v.9.2) nodejs-1:16.20.2-6.el9_2.3, nodejs-docs-1:16.20.2-6.el9_2.3, nodejs-full-i18n-1:16.20.2-6.el9_2.3 +2
Fixes 3 records
Priority LOW 37
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling.
CVSS 3.0MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01155 · Published 2024-05-07 · Partial fix · 18.20.1, 20.12.1 +1 CWE-444
Priority LOW 31
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01309 · Published 2024-03-19 · Partial fix · 18.19.1, 20.11.1 +1 CWE-404
Priority LOW 25
c-ares is a C library for asynchronous DNS requests.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00352 · Published 2024-02-23 · Partial fix · 1.27.0 CWE-127
