Important: Security Update for Node.js
Summary
ALSA-2024:2853: Important: nodejs:20 security update. Affects nodejs versions < 1:20.12.2-2.module_el9.4.0+100+71fc9528. Fixed in 1:20.12.2-2.module_el9.4.0+100+71fc9528. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a software development platform used for building fast and scalable network applications in the JavaScript programming language. It is widely used in web development and provides a runtime environment for executing JavaScript code on the server-side. Node.js allows developers to create efficient and high-performance applications.
Vulnerability Detail
This security update addresses multiple vulnerabilities in Node.js. The vulnerabilities include an out-of-bounds read in the c-ares library, denial-of-service (DoS) vulnerabilities related to CONTINUATION frames in nghttp2 and Node.js, HTTP Request Smuggling via Content Length Obfuscation in Node.js, and a DoS vulnerability when using the fetch() function to retrieve content from an untrusted URL. These vulnerabilities could lead to various security issues, including remote code execution, information disclosure, and denial-of-service attacks.
How To Fix
Minimum fixed version
1:20.12.2-2.module_el9.4.0+100+71fc9528
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to apply the security update as soon as possible to mitigate the risks.
Conclusion
It is crucial to update Node.js to the latest version to protect your applications from potential security risks. Regularly monitoring for security updates and promptly applying them is essential to maintain the security and integrity of your software.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
The vulnerabilities addressed in this security update include an out-of-bounds read in the c-ares library, denial-of-service vulnerabilities related to CONTINUATION frames, HTTP Request Smuggling via Content Length Obfuscation, and a denial-of-service vulnerability when using the fetch() function to retrieve content from an untrusted URL.
These vulnerabilities could lead to various security issues, including remote code execution, information disclosure, and denial-of-service attacks.
To fix these vulnerabilities, it is recommended to update Node.js to version 20.12.2-2.module_el9.4.0+100+71fc9528 or later. Make sure to update all packages and dependencies that rely on Node.js as well.
There are no specific workarounds mentioned for these vulnerabilities. It is recommended to apply the security update as soon as possible to mitigate the risks.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
