Important: Node.js Security Update - Weak Randomness and HTTP Request Smuggling
Summary
RLSA-2022:6963: Important: nodejs security update. Affects nodejs versions < 1:16.17.1-1.el9_0. Fixed in 1:16.17.1-1.el9_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a software development platform that allows developers to build fast and scalable network applications using JavaScript. It is widely used for server-side and networking applications. The vulnerability affects the Node.js package in Rocky Linux 9. Node.js version 16.17.1 is being released to address the security issues.
Vulnerability Detail
The vulnerability includes two security issues:
-
Weak Randomness in WebCrypto Keygen (CVE-2022-35255): This vulnerability allows an attacker to exploit weak randomness in the WebCrypto key generation process. This can lead to the generation of predictable keys, compromising the security of cryptographic operations.
-
HTTP Request Smuggling due to Incorrect Parsing of Header Fields (CVE-2022-35256): This vulnerability arises from incorrect parsing of header fields in HTTP requests. An attacker can manipulate the header fields to bypass security measures, potentially leading to unauthorized access or data leakage.
How To Fix
Minimum fixed version
1:16.17.1-1.el9_0
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Node.js version 16.17.1 addresses the vulnerabilities related to weak randomness in WebCrypto keygen and incorrect parsing of header fields in HTTP requests. It is recommended to update the Node.js package to the latest version to ensure the security of your applications. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a software development platform for building network applications using JavaScript.
CVE-2022-35255 can lead to the generation of predictable cryptographic keys, compromising the security of cryptographic operations.
CVE-2022-35256 can allow attackers to manipulate header fields in HTTP requests, potentially bypassing security measures and gaining unauthorized access or leaking data.
You can update the Node.js package by running the command 'sudo yum update nodejs'.
You can find more information about these vulnerabilities on the CVE pages: CVE-2022-35255 and CVE-2022-35256.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
