Important: Node.js Security and Bug Fix Update
Summary
ALSA-2023:5532: Important: nodejs security and bug fix update. Affects nodejs versions < 1:16.20.2-1.el9_2. Fixed in 1:16.20.2-1.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. It is widely used for server-side and networking applications. Node.js allows developers to use JavaScript on the server-side, providing a unified language for both client-side and server-side development. This vulnerability affects the Node.js package in AlmaLinux:9.
Vulnerability Detail
This vulnerability allows bypassing of permissions policies in Node.js, which can lead to unauthorized access and potential impersonation of other modules. The specific vulnerabilities are as follows:
- CVE-2023-32002: Permissions policies can be bypassed via Module._load.
- CVE-2023-32006: Permissions policies can impersonate other modules using module.constructor.createRequire().
- CVE-2023-32559: Permissions policies can be bypassed via process.binding.
These vulnerabilities can have serious security implications, allowing attackers to gain unauthorized access and potentially execute arbitrary code.
How To Fix
Minimum fixed version
1:16.20.2-1.el9_2
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is important to update the Node.js package to the latest version to address these vulnerabilities and ensure the security of your applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
These vulnerabilities allow bypassing of permissions policies in Node.js, potentially leading to unauthorized access and impersonation of other modules.
To fix these vulnerabilities, update the Node.js package to version 16.20.2-1.el9_2 or later.
No specific workarounds have been provided for these vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
