Important: Security Update for Node.js
Summary
ALSA-2024:2779: Important: nodejs:18 security update. Affects nodejs versions < 1:18.20.2-2.module_el9.4.0+99+a01f7676. Fixed in 1:18.20.2-2.module_el9.4.0+99+a01f7676. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications due to its event-driven architecture and non-blocking I/O model.
Vulnerability Detail
This security update addresses multiple vulnerabilities in Node.js:
-
CVE-2024-27983: This vulnerability allows an attacker to cause a denial of service (DoS) by exploiting CONTINUATION frames.
-
CVE-2024-22025: An attacker can trigger a denial of service (DoS) by using the fetch() function to retrieve content from an untrusted URL.
-
CVE-2024-27982: This vulnerability enables HTTP Request Smuggling via Content Length Obfuscation.
-
CVE-2024-28182: An attacker can exploit CONTINUATION frames to cause a denial of service (DoS) in nghttp2.
-
CVE-2024-25629: This vulnerability in c-ares allows an out-of-bounds read in the ares__read_line() function.
How To Fix
Minimum fixed version
1:18.20.2-2.module_el9.4.0+99+a01f7676
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update as soon as possible.
Conclusion
It is important to update Node.js to the latest version to protect your applications from these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in JavaScript.
This security update addresses multiple vulnerabilities, including DoS vulnerabilities and HTTP Request Smuggling.
To fix these vulnerabilities, update Node.js to version 18.20.2-2.module_el9.4.0+99+a01f7676 or later.
There are no known workarounds for these vulnerabilities. It is crucial to apply the security update.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
