Important: Node.js Security Update
Summary
ALSA-2024:1503: Important: nodejs:18 security update. Affects nodejs versions < 1:18.19.1-1.module_el9.3.0+59+28b95644. Fixed in 1:18.19.1-1.module_el9.3.0+59+28b95644. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model.
Vulnerability Detail
This security update addresses multiple vulnerabilities in Node.js:
-
Code injection and privilege escalation through Linux capabilities (CVE-2024-21892): This vulnerability could allow an attacker to inject malicious code and escalate privileges on a Linux system.
-
Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019): This vulnerability could be exploited to perform denial-of-service attacks by sending specially crafted HTTP requests.
-
Vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809): This vulnerability could enable an attacker to decrypt encrypted data by exploiting timing variations in the PKCS#1 v1.5 padding scheme.
How To Fix
Minimum fixed version
1:18.19.1-1.module_el9.3.0+59+28b95644
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is important to update Node.js to the latest version to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
CVE-2024-21892 could allow an attacker to inject malicious code and escalate privileges on a Linux system.
You can use the Vulert Playground at Vulert Scanner to check if your Node.js installation is affected by these vulnerabilities. Simply upload your package-lock.json file and the Vulert Playground will provide real-time alerts for open-source vulnerabilities.
No specific workarounds have been provided for these vulnerabilities. It is recommended to update Node.js to the latest version.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and related references, on the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
