Node.js: Weak Randomness in WebCrypto Keygen
Summary
ALSA-2022:7821: Important: nodejs:18 security update. Affects nodejs versions < 1:18.9.1-1.module_el8.7.0+3343+ea2b7901. Fixed in 1:18.9.1-1.module_el8.7.0+3343+ea2b7901. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It provides a runtime environment for executing JavaScript code outside of a web browser. Node.js is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model.
Vulnerability Detail
The vulnerability identified as CVE-2022-35255 in Node.js is related to weak randomness in WebCrypto key generation. This vulnerability could allow an attacker to predict or guess the generated keys, compromising the security of cryptographic operations. The impact of this vulnerability can vary depending on the specific use case and the sensitivity of the data being protected.
How To Fix
Minimum fixed version
1:18.9.1-1.module_el8.7.0+3343+ea2b7901
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the latest version of Node.js is the recommended solution.
Conclusion
Node.js version 18.9.1 includes a security update that addresses the weak randomness issue in WebCrypto key generation. It is important to update to this version or later to ensure the security of Node.js applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
WebCrypto is a JavaScript API for performing cryptographic operations in web applications.
This vulnerability could allow an attacker to predict or guess the generated keys, compromising the security of cryptographic operations in Node.js applications.
There is no known exploit for this vulnerability at the moment.
The recommended mitigation is to update the Node.js package to the latest version, which includes a fix for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
