Node.js: Multiple Security Vulnerabilities
Summary
ALSA-2023:1583: Moderate: nodejs:18 security, bug fix, and enhancement update. Affects nodejs versions < 1:18.14.2-2.module_el8.7.0+3497+c65299e7. Fixed in 1:18.14.2-2.module_el8.7.0+3497+c65299e7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a popular software development platform used for building fast and scalable network applications in JavaScript. It provides a runtime environment for executing JavaScript code outside of a web browser. Node.js is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model.
Vulnerability Detail
This vulnerability report highlights multiple security issues in Node.js. The following vulnerabilities have been identified:
-
Regular Expression Denial of Service (CVE-2021-35065): The 'glob-parent' package is affected by a regular expression denial of service vulnerability, which could allow an attacker to cause a denial of service by providing a specially crafted input.
-
Regular Expression Denial of Service (ReDoS) (CVE-2022-25881): The 'http-cache-semantics' package is affected by a regular expression denial of service vulnerability, which could allow an attacker to cause a denial of service by providing a specially crafted input.
-
Permissions Bypass (CVE-2023-23918): Node.js is affected by a vulnerability that allows bypassing permissions policies via the 'process.mainModule' property. This could potentially lead to unauthorized access or privilege escalation.
-
CRLF Injection in Fetch API (CVE-2023-23936): The Fetch API in Node.js is vulnerable to CRLF injection in host headers, which could enable an attacker to manipulate HTTP responses or perform HTTP request smuggling attacks.
-
Insecure Loading of ICU Data (CVE-2023-23920): Node.js insecurely loads ICU (International Components for Unicode) data through the 'ICU_DATA' environment variable. This could potentially lead to arbitrary code execution or other security vulnerabilities.
-
Regular Expression Denial of Service in Headers Fetch API (CVE-2023-24807): The Headers Fetch API in Node.js is affected by a regular expression denial of service vulnerability, which could allow an attacker to cause a denial of service by providing a specially crafted input.
How To Fix
Minimum fixed version
1:18.14.2-2.module_el8.7.0+3497+c65299e7
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to update Node.js to the latest version to ensure the security of your applications.
Conclusion
Node.js is affected by multiple security vulnerabilities that could have serious consequences for the security and stability of your applications. It is highly recommended to update Node.js to the latest version (18.14.2) to mitigate these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
The security vulnerabilities in Node.js include regular expression denial of service, permissions bypass, CRLF injection, insecure loading of ICU data, and regular expression denial of service in the Headers Fetch API.
These vulnerabilities could lead to denial of service, unauthorized access, privilege escalation, HTTP request smuggling, arbitrary code execution, and other security vulnerabilities.
To fix these vulnerabilities, update Node.js to the latest version (18.14.2) by following the official documentation provided by the Node.js project.
There are no known workarounds for these vulnerabilities. It is crucial to update Node.js to the latest version to ensure the security of your applications.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
