Important: Node.js 10 Security Update
Summary
ALSA-2020:2848: Important: nodejs:10 security update. Affects nodejs-nodemon across 2 version ranges.
< 1.18.3-1.module_el8.3.0+2023+d2377ea3
< 1.18.3-1.module_el8.3.0+2047+b07ac28e
Fixed in 1.18.3-1.module_el8.3.0+2023+d2377ea3 or 1.18.3-1.module_el8.3.0+2047+b07ac28e, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications. The vulnerability affects the Node.js version 10.21.0.
Vulnerability Detail
The vulnerability includes the following security issues:
- CVE-2020-11080: nghttp2 - Overly large SETTINGS frames can lead to Denial of Service (DoS).
- CVE-2020-7598: nodejs-minimist - Prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload.
- CVE-2020-8174: nodejs - Memory corruption in napi_get_value_string_* functions.
These vulnerabilities can be exploited by attackers to cause a DoS, manipulate object properties, or execute arbitrary code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 1.18.3-1.module_el8.3.0+2023+d2377ea31.18.3-1.module_el8.3.0+2023+d2377ea3 -
< 1.18.3-1.module_el8.3.0+2047+b07ac28e1.18.3-1.module_el8.3.0+2047+b07ac28e
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is crucial to update the Node.js package to the latest version as soon as possible.
Conclusion
It is highly recommended to update the Node.js package to version 10.21.0 or later to mitigate the security vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
These vulnerabilities can be exploited by attackers to cause a Denial of Service (DoS), manipulate object properties, or execute arbitrary code.
To fix the vulnerabilities, update the Node.js package to version 10.21.0 or later by running the command 'npm install node@10.21.0'.
There are no known workarounds for these vulnerabilities. It is crucial to update the Node.js package to the latest version.
You can find more information about these vulnerabilities on the CVE pages: CVE-2020-11080, CVE-2020-7598, CVE-2020-8174.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
