Red Hat Security Advisory

RHSA-2024:4824

nodejs:18 security update

Released 2024-07-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.8.8) nodejs-1:18.19.1-3.module+el8.8.0+22005+6f8bb252.aarch64::nodejs:18, nodejs-1:18.19.1-3.module+el8.8.0+22005+6f8bb252.ppc64le::nodejs:18, nodejs-1:18.19.1-3.module+el8.8.0+22005+6f8bb252.s390x::nodejs:18 +20

Fixes 2 records

TI-2024-18584 CVE-2024-27983 · GHSA-j65r-8hrg-qc6x

Race condition in NodeJS Node

HIGH 84

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside.

CVSS 3.0HIGH 8.2 Network No auth No interaction EPSS 0.87211 Published 2024-04-09 Partial fix · 18.20.1, 20.12.1 +1 CWE-362

TI-2024-18758 CVE-2024-28182

Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

HIGH 71

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.81994 Published 2024-04-04 Partial fix · 1.61.0 CWE-770