Important: Node.js 14 Security and Bug Fix Update
Summary
ALSA-2021:0744: Important: nodejs:14 security and bug fix update. Affects nodejs-nodemon versions < 2.0.3-1.module_el8.4.0+2521+c668cc9f. Fixed in 2.0.3-1.module_el8.4.0+2521+c668cc9f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model. Node.js allows developers to write JavaScript code that runs on the server, providing a seamless transition between client-side and server-side programming. This vulnerability affects Node.js version 14.16.0.
Vulnerability Detail
The vulnerability identified in this update includes two security issues:
-
CVE-2021-22883: This vulnerability in the HTTP2 module of Node.js can be exploited to cause a denial-of-service (DoS) attack by exhausting system resources. An attacker can send a specially crafted request that triggers the 'unknownProtocol' error, leading to resource exhaustion and potentially crashing the server.
-
CVE-2021-22884: This vulnerability affects the --inspect feature of Node.js, which is used for debugging and profiling. It allows an attacker to perform DNS rebinding attacks, enabling them to bypass security restrictions and potentially access sensitive information or execute arbitrary code on the target system.
How To Fix
Minimum fixed version
2.0.3-1.module_el8.4.0+2521+c668cc9f
This is the first release that contains the fix.
sudo dnf update nodejs-nodemonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is essential to update Node.js to the latest version as soon as possible to mitigate the risks.
Conclusion
In conclusion, it is crucial to update Node.js to the latest version (14.16.0) to address the identified security vulnerabilities. By doing so, you can protect your applications and systems from potential denial-of-service attacks and DNS rebinding exploits. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
CVE-2021-22883 is a security vulnerability in the HTTP2 module of Node.js that can be exploited for a denial-of-service attack.
CVE-2021-22884 is a vulnerability in the --inspect feature of Node.js that allows DNS rebinding attacks.
You can update Node.js by following the official documentation and using the appropriate package manager or installer for your operating system.
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to update Node.js to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
