Important: Node.js 16 Security Update
Summary
ALSA-2023:4034: Important: nodejs:16 security update. Affects nodejs versions < 1:16.19.1-2.module_el8.8.0+3586+d4fc0b72. Fixed in 1:16.19.1-2.module_el8.8.0+3586+d4fc0b72. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications. The vulnerability affects the following packages: nodejs, nodejs-devel, nodejs-docs, nodejs-full-i18n, nodejs-nodemon, nodejs-packaging, and npm.
Vulnerability Detail
The vulnerability includes several security fixes:
- CVE-2023-32067: 0-byte UDP payload Denial of Service in c-ares
- CVE-2023-31130: Buffer Underwrite in ares_inet_net_pton() in c-ares
- CVE-2023-31147: Insufficient randomness in generation of DNS query IDs in c-ares
- CVE-2023-31124: AutoTools does not set CARES_RANDOM_FILE during cross compilation in c-ares
These vulnerabilities can lead to various security issues, including denial of service attacks and potential information disclosure.
How To Fix
Minimum fixed version
1:16.19.1-2.module_el8.8.0+3586+d4fc0b72
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is recommended to update the affected packages as soon as possible.
Conclusion
It is important to update the affected packages to the recommended versions to mitigate the security risks associated with these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
These vulnerabilities can lead to denial of service attacks and potential information disclosure.
To fix the vulnerability, update the affected packages to the recommended versions.
No workaround has been provided for this vulnerability. It is recommended to update the affected packages.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
