Critical Node.js Vulnerability in Ubuntu Packages: USN-7469-3
Summary
USN-7469-3: nodejs vulnerability. Affects nodejs versions < 8.10.0~dfsg-2ubuntu0.4+esm6. Fixed in 8.10.0~dfsg-2ubuntu0.4+esm6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine, widely used for building scalable network applications. It allows developers to use JavaScript for server-side scripting, enabling the creation of dynamic web pages. The vulnerability in question affects multiple versions of Node.js across different Ubuntu LTS releases, specifically versions 8.10.0, 10.19.0, and 12.22.9, which could lead to denial of service due to poor resource management in the HTTP/2 protocol.
Vulnerability Detail
The vulnerability, identified as CVE-2023-44487, originates from Apache Traffic Server's poor server resource management in its HTTP/2 protocol. An attacker could exploit this vulnerability to cause the server to crash, resulting in a denial of service. This could severely impact applications relying on Node.js for handling HTTP/2 requests, leading to downtime and potential data loss.
How To Fix
Minimum fixed version
8.10.0~dfsg-2ubuntu0.4+esm6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling HTTP/2 support in your Node.js applications until the patch is applied. This can be done by modifying the server configuration to use HTTP/1.1 instead.
Conclusion
In summary, the vulnerability identified as USN-7469-3 affects multiple versions of Node.js in Ubuntu, posing a risk of denial of service due to poor resource management in the HTTP/2 protocol. It is crucial to update to the patched versions to mitigate this risk and ensure the stability of applications.
See every vulnerability recorded for nodejs →
FAQ
CVE-2023-44487 is a vulnerability in Node.js related to poor resource management in the HTTP/2 protocol, which can lead to denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Not addressing this vulnerability can lead to application downtime, denial of service, and potential data loss, affecting user experience and trust.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
The affected versions include Node.js 8.10.0, 10.19.0, and 12.22.9 across different Ubuntu LTS releases.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
