Moderate Vulnerability in Node.js Packaging: Security and Bug Fix Update
Summary
RLSA-2023:2654: Moderate: nodejs:18 security, bug fix, and enhancement update. Affects nodejs-packaging across 4 version ranges.
< 0:2021.06-4.module+el9.7.0+40025+0e0cf6b2
< 0:2021.06-4.module+el9.7.0+40017+f0db1785
< 0:2021.06-4.module+el9.7.0+40018+a011993d
< 0:2021.06-4.module+el9.7.0+40022+9ecc286c
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful software development platform designed for building fast and scalable network applications using JavaScript. It is widely used for server-side development and has a rich ecosystem of libraries and frameworks. The recent updates to Node.js packaging address several security vulnerabilities that could potentially impact applications relying on this platform.
Vulnerability Detail
The vulnerabilities identified in Node.js packaging include several critical issues such as Regular Expression Denial of Service (ReDoS), buffer overflow, and permission policy bypasses. These vulnerabilities can lead to service disruptions, unauthorized access, and potential data breaches. Specific vulnerabilities include CVE-2021-35065, CVE-2022-25881, CVE-2022-4904, and multiple others that affect the core functionalities of Node.js and its libraries.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-packaging-
< 0:2021.06-4.module+el9.7.0+40017+f0db17850:2021.06-4.module+el9.7.0+40017+f0db1785 -
< 0:2021.06-4.module+el9.7.0+40018+a011993d0:2021.06-4.module+el9.7.0+40018+a011993d -
< 0:2021.06-4.module+el9.7.0+40022+9ecc286c0:2021.06-4.module+el9.7.0+40022+9ecc286c -
< 0:2021.06-4.module+el9.7.0+40025+0e0cf6b20:2021.06-4.module+el9.7.0+40025+0e0cf6b2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization to mitigate the risk of Regular Expression Denial of Service attacks. Additionally, review your application's permission policies to ensure they are not vulnerable to bypass.
Conclusion
In summary, the recent updates to Node.js packaging address several critical vulnerabilities that could impact applications built on this platform. It is crucial to update to the latest patched versions to ensure the security and integrity of your applications. Utilize tools like Vulert for ongoing monitoring and vulnerability management.
See every vulnerability recorded for nodejs-packaging →
FAQ
The CVSS score of the vulnerability is 8.6, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerabilities can lead to service disruptions, unauthorized access, and potential data breaches, affecting the integrity and availability of applications.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Implement input validation and sanitization as a temporary measure to mitigate risks until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs-packaging.
