Important: Node.js 12 Security Update
Summary
ALSA-2020:2852: Important: nodejs:12 security update. Affects nodejs-nodemon across 2 version ranges.
< 1.18.3-1.module_el8.3.0+2023+d2377ea3
< 1.18.3-1.module_el8.3.0+2047+b07ac28e
Fixed in 1.18.3-1.module_el8.3.0+2023+d2377ea3 or 1.18.3-1.module_el8.3.0+2047+b07ac28e, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications. The vulnerability affects the Node.js package in version 12.18.2.
Vulnerability Detail
The vulnerability includes the following security issues:
- CVE-2020-11080: nghttp2 - Overly large SETTINGS frames can lead to Denial of Service (DoS) attacks.
- CVE-2020-7598: nodejs-minimist - Prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload.
- CVE-2020-8172: nodejs - TLS session reuse can lead to hostname verification bypass.
- CVE-2020-8174: nodejs - Memory corruption in napi_get_value_string_* functions.
These vulnerabilities can have various impacts, including DoS attacks, unauthorized access, and memory corruption.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-nodemon-
< 1.18.3-1.module_el8.3.0+2023+d2377ea31.18.3-1.module_el8.3.0+2023+d2377ea3 -
< 1.18.3-1.module_el8.3.0+2047+b07ac28e1.18.3-1.module_el8.3.0+2047+b07ac28e
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
It is important to update the Node.js package to version 12.18.2 or later to address these security vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
These vulnerabilities can lead to DoS attacks, unauthorized access, and memory corruption.
To fix the vulnerabilities, update the Node.js package to version 12.18.2 or later.
No specific workarounds have been provided for these vulnerabilities.
You can find more information about these vulnerabilities on the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
