Important: Node.js 12 Security Update
Summary
ALSA-2020:0598: Important: nodejs:12 security update. Affects nodejs-nodemon across 2 version ranges.
< 1.18.3-1.module_el8.3.0+2023+d2377ea3
< 1.18.3-1.module_el8.3.0+2047+b07ac28e
Fixed in 1.18.3-1.module_el8.3.0+2023+d2377ea3 or 1.18.3-1.module_el8.3.0+2047+b07ac28e, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model. Node.js allows developers to write JavaScript code that runs on the server, providing a seamless transition from front-end to back-end development. However, like any software, Node.js is susceptible to security vulnerabilities that can compromise the integrity and security of applications built on top of it.
Vulnerability Detail
This security update addresses multiple vulnerabilities in Node.js version 12.16.1. The vulnerabilities include:
-
CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding header
-
CVE-2019-15604: Remotely trigger an assertion on a TLS server with a malformed certificate string
-
CVE-2019-15606: HTTP header values do not have trailing optional whitespace trimmed
These vulnerabilities can be exploited by malicious actors to perform various attacks, such as HTTP request smuggling and triggering assertion failures on TLS servers. The impact of these vulnerabilities can range from information disclosure to remote code execution, depending on the specific circumstances of the attack.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 1.18.3-1.module_el8.3.0+2023+d2377ea31.18.3-1.module_el8.3.0+2023+d2377ea3 -
< 1.18.3-1.module_el8.3.0+2047+b07ac28e1.18.3-1.module_el8.3.0+2047+b07ac28e
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to update the Node.js package to the latest version to ensure the security of your applications.
Conclusion
Node.js version 12.16.1 addresses multiple security vulnerabilities that can be exploited by attackers. It is crucial to update your Node.js package to the latest version to protect your applications from potential attacks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
This security update addresses three vulnerabilities: CVE-2019-15605, CVE-2019-15604, and CVE-2019-15606. These vulnerabilities can be exploited to perform various attacks, such as HTTP request smuggling and triggering assertion failures on TLS servers.
The impact of these vulnerabilities can range from information disclosure to remote code execution, depending on the specific circumstances of the attack.
To fix these vulnerabilities, it is recommended to update the Node.js package to version 12.16.1 or later. This can be done by running the package manager command: npm install node@12.16.1
There are no known workarounds for these vulnerabilities. It is essential to update the Node.js package to the latest version to ensure the security of your applications.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
