Important: Node.js 12 Security and Bug Fix Update
Summary
ALSA-2021:3623: Important: nodejs:12 security and bug fix update. Affects nodejs across 2 version ranges.
< 1:12.22.5-1.module_el8.4.0+2529+af52a4c7
< 1:12.22.5-1.module_el8.5.0+85+79a7b441
Fixed in 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 or 1:12.22.5-1.module_el8.5.0+85+79a7b441, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications. Node.js 12 is a specific version of Node.js that introduces various features and improvements.
Vulnerability Detail
This security update addresses multiple vulnerabilities in Node.js 12. These vulnerabilities include:
-
Use-after-free on close http2 on stream canceling (CVE-2021-22930, CVE-2021-22940): These vulnerabilities could allow an attacker to execute arbitrary code or cause a denial of service by exploiting a use-after-free issue in the http2 module.
-
Missing input validation of host names may lead to domain hijacking (CVE-2021-3672): This vulnerability could allow an attacker to hijack domain names by exploiting a lack of input validation in the c-ares library.
-
Improper handling of untypical characters in domain names (CVE-2021-22931): This vulnerability could allow an attacker to perform domain spoofing attacks by manipulating domain names with untypical characters.
-
Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803, CVE-2021-32804): These vulnerabilities could allow an attacker to create or overwrite arbitrary files on the system by exploiting insufficient symlink protection in the nodejs-tar module.
-
Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939): This vulnerability could allow an attacker to bypass TLS certificate validation by manipulating the rejectUnauthorized parameter in the tls module.
-
ReDoS via splitDeviceRe, splitTailRe, and splitPathRe (CVE-2021-23343): This vulnerability could allow an attacker to perform a regular expression denial of service (ReDoS) attack by manipulating certain regular expressions in the nodejs-path-parse module.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-
< 1:12.22.5-1.module_el8.4.0+2529+af52a4c71:12.22.5-1.module_el8.4.0+2529+af52a4c7 -
< 1:12.22.5-1.module_el8.5.0+85+79a7b4411:12.22.5-1.module_el8.5.0+85+79a7b441
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
It is crucial to update Node.js 12 and the affected packages to the latest fixed versions to mitigate the risks associated with these vulnerabilities. Failure to do so may expose your applications to potential attacks and security breaches. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
These vulnerabilities could allow an attacker to execute arbitrary code, cause a denial of service, perform domain hijacking, bypass TLS certificate validation, or perform a regular expression denial of service (ReDoS) attack.
To fix these vulnerabilities, it is recommended to update Node.js 12 to the latest version available. Please refer to the 'how_to_fix' section for more details.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update the affected packages to the latest fixed versions.
You can find more information about these vulnerabilities, including their CVE identifiers, in the 'vulnerability' section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
