Important: Node.js 16 Security Update
Summary
ALSA-2024:1444: Important: nodejs:16 security update. Affects nodejs versions < 1:16.20.2-4.module_el8.9.0+3747+ead8229c. Fixed in 1:16.20.2-4.module_el8.9.0+3747+ead8229c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It provides a runtime environment for executing JavaScript code outside of a web browser. Node.js is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model.
Vulnerability Detail
This security update addresses two vulnerabilities in Node.js:
-
CVE-2024-22019: Reading unprocessed HTTP requests with unbounded chunk extension allows denial-of-service (DoS) attacks. An attacker can send specially crafted HTTP requests to exhaust server resources and cause a DoS condition.
-
CVE-2023-44487: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack known as the Rapid Reset Attack. This attack can be used to consume excessive server resources and disrupt the availability of the affected web servers.
How To Fix
Minimum fixed version
1:16.20.2-4.module_el8.9.0+3747+ead8229c
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to update Node.js to the latest version as soon as possible.
Conclusion
Node.js users are advised to update their installations to the latest version to mitigate the risks associated with these vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
CVE-2024-22019 is a vulnerability in Node.js that allows reading unprocessed HTTP requests with unbounded chunk extension, leading to potential denial-of-service attacks.
CVE-2023-44487 is a vulnerability in Node.js HTTP/2 implementation that makes multiple HTTP/2 enabled web servers vulnerable to a DDoS attack known as the Rapid Reset Attack.
To fix these vulnerabilities, update Node.js to version 16.20.2-4.module_el8.9.0+3747+ead8229c or later.
There are no known workarounds for these vulnerabilities. It is recommended to update Node.js to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
