Important: Node.js Security Update
Summary
ALSA-2024:1510: Important: nodejs:18 security update. Affects nodejs versions < 1:18.19.1-1.module_el8.9.0+3753+4de0891b. Fixed in 1:18.19.1-1.module_el8.9.0+3753+4de0891b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model.
Vulnerability Detail
This security update addresses multiple vulnerabilities in Node.js:
- CVE-2024-22019: Reading unprocessed HTTP requests with unbounded chunk extension allows denial-of-service (DoS) attacks.
- CVE-2023-46809: Node.js is vulnerable to a timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin).
- CVE-2024-21892: Node.js is susceptible to code injection and privilege escalation through Linux capabilities.
These vulnerabilities can lead to various security issues, including DoS attacks, data leakage, and unauthorized access to system resources.
How To Fix
Minimum fixed version
1:18.19.1-1.module_el8.9.0+3753+4de0891b
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update as soon as possible.
Conclusion
Node.js has released a security update to address multiple vulnerabilities. It is recommended to update Node.js to the latest version to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
This update addresses three vulnerabilities: CVE-2024-22019, CVE-2023-46809, and CVE-2024-21892.
These vulnerabilities can lead to denial-of-service attacks, data leakage, and unauthorized access to system resources.
To fix these vulnerabilities, update Node.js to version 18.19.1-1.module_el8.9.0+3753+4de0891b or later.
There are no known workarounds for these vulnerabilities. It is crucial to apply the security update.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
