Improper Certificate Validation in Node.js
Summary
CVE-2019-15604: Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate. Affects nodejs across 2 version ranges.
< 10.19.0-r0
>= cf41627411886000429bde058a6594fb7f6d6d47, < 5ba7df3c4b81ab695029dacf34a0aa960be71372
Fixed in 10.19.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance applications. However, Node.js is vulnerable to an improper certificate validation issue, which can lead to process aborts when a crafted X.509 certificate is sent.
Vulnerability Detail
The vulnerability (CVE-2019-15604) originates from a flaw in the certificate validation process of Node.js versions 10, 12, and 13. When a specially crafted X.509 certificate is received, the process may abruptly terminate. This vulnerability can be exploited by an attacker to disrupt the availability of affected Node.js applications.
How To Fix
Minimum fixed version
10.19.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update Node.js to the fixed versions mentioned above to mitigate the risk.
Conclusion
The improper certificate validation vulnerability in Node.js can lead to process aborts and denial of service conditions. It is crucial to update Node.js to the fixed versions mentioned above to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
This vulnerability can cause the affected Node.js process to abruptly terminate, leading to a denial of service (DoS) condition for the application.
Node.js versions 10, 12, and 13 are affected by this vulnerability.
Yes, this vulnerability can be exploited remotely by sending a specially crafted X.509 certificate to the affected Node.js application.
No, there are no known workarounds for this vulnerability. Updating to the fixed versions of Node.js is the recommended solution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
