Moderate: nodejs:14 security, bug fix, and enhancement update
Summary
ALSA-2021:3074: Moderate: nodejs:14 security, bug fix, and enhancement update. Affects nodejs-nodemon versions < 2.0.3-1.module_el8.4.0+2521+c668cc9f. Fixed in 2.0.3-1.module_el8.4.0+2521+c668cc9f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It provides a runtime environment for executing JavaScript code outside of a web browser. Node.js is widely used for server-side development and has a large ecosystem of packages and libraries available for developers to use. The nodejs package is a core component of the Node.js platform and includes the Node.js runtime, as well as various tools and modules for building and running Node.js applications.
Vulnerability Detail
This update addresses several security vulnerabilities in the nodejs package:
-
CVE-2021-23362: This vulnerability in the nodejs-hosted-git-info package could allow an attacker to cause a denial of service (DoS) by exploiting a regular expression denial of service (ReDoS) vulnerability.
-
CVE-2021-27290: This vulnerability in the nodejs-ssri package could allow an attacker to cause a denial of service (DoS) by exploiting a regular expression denial of service (ReDoS) vulnerability when parsing malicious Subresource Integrity (SRI) in strict mode.
-
CVE-2021-22918: This vulnerability in the libuv package could allow an attacker to read out-of-bounds memory, potentially leading to information disclosure or crashes.
These vulnerabilities could be exploited by remote attackers to disrupt the availability of affected systems or potentially disclose sensitive information.
How To Fix
Minimum fixed version
2.0.3-1.module_el8.4.0+2521+c668cc9f
This is the first release that contains the fix.
sudo dnf update nodejs-nodemonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the nodejs package has been updated to address several security vulnerabilities. It is recommended to update the package to the latest version to ensure the security and stability of your Node.js applications. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs-nodemon →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The nodejs package is a core component of the Node.js platform and includes the Node.js runtime, as well as various tools and modules for building and running Node.js applications.
A regular expression denial of service (ReDoS) vulnerability is a type of security vulnerability that occurs when a regular expression pattern takes a long time to evaluate certain inputs, causing the application to become unresponsive or consume excessive resources.
Subresource Integrity (SRI) is a security feature that allows web developers to ensure that resources (such as scripts or stylesheets) loaded from third-party sources have not been tampered with. It uses cryptographic hashes to verify the integrity of the resources.
You can update the nodejs package on AlmaLinux 8 by running the following command:
$ sudo dnf update nodejs
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-nodemon.
