Important: Node.js 10 Security Update
Summary
ALSA-2019:2925: Important: nodejs:10 security update. Affects nodejs-nodemon across 2 version ranges.
< 1.18.3-1.module_el8.3.0+2023+d2377ea3
< 1.18.3-1.module_el8.3.0+2047+b07ac28e
Fixed in 1.18.3-1.module_el8.3.0+2023+d2377ea3 or 1.18.3-1.module_el8.3.0+2047+b07ac28e, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model. The vulnerability described in this report affects Node.js version 10.16.3.
Vulnerability Detail
The vulnerability in Node.js version 10.16.3 is related to the HTTP/2 protocol implementation. It allows an attacker to exploit various flaws in the protocol, leading to denial of service (DoS) attacks and excessive resource consumption. The specific vulnerabilities include:
- CVE-2019-9511: Large amount of data requests leads to DoS.
- CVE-2019-9512: Flood using PING frames results in unbounded memory growth.
- CVE-2019-9513: Flood using PRIORITY frames results in excessive resource consumption.
- CVE-2019-9514: Flood using HEADERS frames results in unbounded memory growth.
- CVE-2019-9515: Flood using SETTINGS frames results in unbounded memory growth.
- CVE-2019-9516: 0-length headers lead to DoS.
- CVE-2019-9517: Request for large response leads to DoS.
- CVE-2019-9518: Flood using empty frames results in excessive resource consumption.
These vulnerabilities can be exploited by an attacker to disrupt the normal functioning of a Node.js server or consume excessive resources, potentially leading to service unavailability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 1.18.3-1.module_el8.3.0+2023+d2377ea31.18.3-1.module_el8.3.0+2023+d2377ea3 -
< 1.18.3-1.module_el8.3.0+2047+b07ac28e1.18.3-1.module_el8.3.0+2047+b07ac28e
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a newer version of Node.js is not immediately feasible, a possible workaround is to disable the HTTP/2 protocol in the Node.js server configuration. This can be achieved by modifying the server code or configuration file to use the HTTP/1.1 protocol instead. However, this workaround may impact the performance and capabilities of the server, so upgrading to a patched version is still recommended.
Conclusion
In conclusion, the vulnerability in Node.js version 10.16.3 can be mitigated by upgrading to a patched version or by applying a workaround. It is important to take action to protect your Node.js server from potential exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
These vulnerabilities can be exploited to disrupt the normal functioning of a Node.js server or consume excessive resources, potentially leading to service unavailability.
To fix the vulnerability, it is recommended to upgrade the Node.js package to a later version that includes the security patches.
If upgrading to a newer version of Node.js is not immediately feasible, a possible workaround is to disable the HTTP/2 protocol in the Node.js server configuration.
More information about these vulnerabilities can be found in the CVE pages listed in the References section of the original vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
