Red Hat Security Advisory

RHSA-2024:4721

nodejs security update

Released 2024-07-23 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.0) nodejs-1:16.20.2-9.el9_0, nodejs-docs-1:16.20.2-9.el9_0, nodejs-full-i18n-1:16.20.2-9.el9_0 +2

Fixes 3 records

TI-2024-18758 CVE-2024-28182

Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

HIGH 71

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.81994 Published 2024-04-04 Partial fix · 1.61.0 CWE-770

TI-2024-14646 CVE-2024-22025 · GHSA-xp28-3fv9-33c6

A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS)…

LOW 31

A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01309 Published 2024-03-19 Partial fix · 18.19.1, 20.11.1 +1 CWE-404

TI-2024-16857 CVE-2024-25629

c-ares out of bounds read in ares__read_line()

LOW 25

c-ares is a C library for asynchronous DNS requests.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00352 Published 2024-02-23 Partial fix · 1.27.0 CWE-127