Important: Security Update for Node.js
Summary
ALSA-2024:2778: Important: nodejs:20 security update. Affects nodejs versions < 1:20.12.2-2.module_el8.9.0+3827+11b91f3e. Fixed in 1:20.12.2-2.module_el8.9.0+3827+11b91f3e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform that allows developers to build fast and scalable network applications using JavaScript. It is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model.
Vulnerability Detail
This security update addresses multiple vulnerabilities in Node.js. These vulnerabilities include:
- Out of bounds read in ares__read_line() (CVE-2024-25629)
- Denial of service via fetch() function (CVE-2024-22025)
- Denial of service via CONTINUATION frames (CVE-2024-27983)
- HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)
- Denial of service via CONTINUATION frames in nghttp2 (CVE-2024-28182)
These vulnerabilities could allow an attacker to execute arbitrary code, cause a denial of service, or perform HTTP request smuggling attacks.
How To Fix
Minimum fixed version
1:20.12.2-2.module_el8.9.0+3827+11b91f3e
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to update Node.js to the latest version.
Conclusion
It is important to update Node.js to the latest version to protect your application from these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building network applications using JavaScript.
These vulnerabilities could allow an attacker to execute arbitrary code, cause a denial of service, or perform HTTP request smuggling attacks.
To fix these vulnerabilities, update Node.js to version 20.12.2-2.module_el8.9.0+3827+11b91f3e or later.
There are no known workarounds for these vulnerabilities. It is recommended to update Node.js to the latest version.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
