Important: Node.js Security Update
Summary
ALSA-2023:5869: Important: nodejs:18 security update. Affects nodejs versions < 1:18.18.2-1.module_el8.8.0+3652+0e111ba0. Fixed in 1:18.18.2-1.module_el8.8.0+3652+0e111ba0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model. Node.js allows developers to write JavaScript code that runs on the server, providing a powerful and efficient environment for building web applications.
Vulnerability Detail
The Node.js security update addresses multiple vulnerabilities that could potentially be exploited by attackers. These vulnerabilities include:
-
HTTP/2 Rapid Reset Attack (CVE-2023-44487): Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack. This vulnerability allows an attacker to send specially crafted requests that cause the server to rapidly reset connections, leading to a denial of service.
-
Integrity Check Bypass (CVE-2023-38552): This vulnerability allows an attacker to bypass integrity checks according to policies, potentially leading to code execution or privilege escalation.
-
Code Injection via WebAssembly Export Names (CVE-2023-39333): Attackers can inject malicious code into Node.js applications by exploiting a vulnerability in WebAssembly export names. This can lead to remote code execution or other security compromises.
-
Cookie Leakage in node-undici (CVE-2023-45143): The node-undici package is vulnerable to cookie leakage, allowing an attacker to access sensitive information stored in cookies.
These vulnerabilities pose a significant risk to Node.js applications and should be addressed immediately.
How To Fix
Minimum fixed version
1:18.18.2-1.module_el8.8.0+3652+0e111ba0
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to apply the security updates as soon as possible.
Conclusion
It is crucial to update the affected Node.js packages to the latest secure versions to mitigate the risk of exploitation. Failure to do so may result in potential security breaches and compromise of sensitive information. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
These vulnerabilities can lead to denial of service, code execution, privilege escalation, and leakage of sensitive information.
To fix these vulnerabilities, update the affected Node.js packages to the latest secure versions.
There are no known workarounds for these vulnerabilities. Applying the security updates is the recommended solution.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the AlmaLinux Security Bulletin.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
