Important: Node.js 14 Security, Bug Fix, and Enhancement Update
Summary
ALSA-2023:1743: Important: nodejs:14 security, bug fix, and enhancement update. Affects nodejs versions < 1:14.21.3-1.module_el8.7.0+3551+53700ee8. Fixed in 1:14.21.3-1.module_el8.7.0+3551+53700ee8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It provides a runtime environment that allows developers to execute JavaScript code outside of a web browser. Node.js is widely used for server-side applications and has a large ecosystem of packages and libraries available for developers to leverage.
The vulnerability affects the following packages: nodejs, nodejs-devel, nodejs-docs, nodejs-full-i18n, nodejs-nodemon, nodejs-packaging, and npm.
Vulnerability Detail
The vulnerability in Node.js is related to several security issues that have been fixed in the latest update. These include:
- CVE-2022-38900: Improper input validation in the decode-uri-component package could lead to a denial of service (DoS) attack.
- CVE-2021-35065: The glob-parent package is vulnerable to regular expression denial of service (ReDoS) attacks.
- CVE-2022-3517: The nodejs-minimatch package is vulnerable to ReDoS attacks via the braceExpand function.
- CVE-2022-4904: The c-ares package is vulnerable to a buffer overflow in the config_sortlist() function.
- CVE-2022-25881: The http-cache-semantics package is vulnerable to ReDoS attacks.
- CVE-2023-23918: Node.js is vulnerable to bypassing permissions policies via the process.mainModule.
- CVE-2023-23920: Node.js is vulnerable to insecure loading of ICU data through the ICU_DATA environment variable.
These vulnerabilities could allow an attacker to execute arbitrary code, cause a denial of service, or bypass security restrictions.
How To Fix
Minimum fixed version
1:14.21.3-1.module_el8.7.0+3551+53700ee8
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, it is important to update the affected Node.js packages to the latest version to address the security vulnerabilities. By keeping your software up to date, you can mitigate the risk of exploitation and ensure the security of your applications. If you need further assistance or support in addressing these vulnerabilities, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
These vulnerabilities could allow an attacker to execute arbitrary code, cause a denial of service, or bypass security restrictions.
To fix the vulnerability, it is recommended to update the affected packages to the latest version.
You can update the nodejs package on AlmaLinux 8 by running the command 'sudo dnf update nodejs'.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
