Important: Node.js Security Update
Summary
ALSA-2023:5362: Important: nodejs:18 security, bug fix, and enhancement update. Affects nodejs versions < 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d. Fixed in 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model. Node.js allows developers to create efficient and high-performance applications.
Vulnerability Detail
The Node.js package is affected by multiple security vulnerabilities that have been addressed in this update. These vulnerabilities include:
- CVE-2023-32002: Permissions policies can be bypassed via Module._load.
- CVE-2022-25883: Regular expression denial of service in nodejs-semver.
- CVE-2023-32006: Permissions policies can impersonate other modules using module.constructor.createRequire().
- CVE-2023-32559: Permissions policies can be bypassed via process.binding.
These vulnerabilities could allow an attacker to bypass permissions policies, impersonate modules, or cause denial of service. The impact of these vulnerabilities may vary depending on the specific use case and configuration of the affected Node.js application.
How To Fix
Minimum fixed version
1:18.17.1-1.module_el8.8.0+3613+1ed8c91d
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is strongly recommended to update the Node.js package to the latest version to ensure the security of your application.
Conclusion
It is crucial to update the Node.js package to the latest version to mitigate the security vulnerabilities. Failure to do so may expose your application to potential attacks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
This update addresses multiple security vulnerabilities, including permissions bypass, denial of service, and module impersonation.
These vulnerabilities could allow an attacker to bypass permissions policies, impersonate modules, or cause denial of service.
To fix these vulnerabilities, update the Node.js package to the latest version (18) following the provided instructions.
There are no known workarounds for these vulnerabilities. Updating the Node.js package is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
