Important: Node.js 18 Security, Bug Fix, and Enhancement Update
Summary
ALSA-2023:5363: Important: nodejs:18 security, bug fix, and enhancement update. Affects nodejs versions < 1:18.17.1-1.module_el9.2.0+36+853e48f5. Fixed in 1:18.17.1-1.module_el9.2.0+36+853e48f5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It provides a runtime environment for executing JavaScript code outside of a web browser. Node.js allows developers to create server-side and networking applications with ease.
Vulnerability Detail
The Node.js package (version 18) is affected by multiple security vulnerabilities:
-
CVE-2023-32002: Permissions policies can be bypassed via Module._load. This vulnerability allows an attacker to bypass permissions policies and potentially execute unauthorized actions.
-
CVE-2022-25883: Regular expression denial of service in the nodejs-semver package. This vulnerability can be exploited by an attacker to cause a denial of service by sending specially crafted input.
-
CVE-2023-32006: Permissions policies can impersonate other modules using module.constructor.createRequire(). This vulnerability allows an attacker to impersonate other modules and potentially execute unauthorized actions.
-
CVE-2023-32559: Permissions policies can be bypassed via process.binding. This vulnerability allows an attacker to bypass permissions policies and potentially execute unauthorized actions.
How To Fix
Minimum fixed version
1:18.17.1-1.module_el9.2.0+36+853e48f5
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is strongly advised to update to the latest version of the Node.js package.
Conclusion
It is crucial to update the Node.js package to the latest version to mitigate these security vulnerabilities. Failure to do so may expose your application to potential unauthorized actions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
These vulnerabilities can allow an attacker to bypass permissions policies, impersonate other modules, and potentially execute unauthorized actions.
To fix these vulnerabilities, update the Node.js package to version 18.17.1-1.module_el9.2.0+36+853e48f5 or later.
There are no known workarounds for these vulnerabilities. It is recommended to update to the latest version of the Node.js package.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
