Summary
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)
* nghttp2: CONTINUATION frames DoS (CVE-2024-28182)
* nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service (CVE-2024-22025)
* nodejs: CONTINUATION frames DoS (CVE-2024-27983)
* nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | nodejs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux · 8 | nodejs-devel | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux · 8 | nodejs-docs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux · 8 | nodejs-full-i18n | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e |
| AlmaLinux · 8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 |
| AlmaLinux · 8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux · 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux · 8 | npm | 1:10.5.0-1.20.12.2.2.module_el8.9.0+3827+11b91f3e |
Vulnerabilities 5
-
High 8.2
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packet…
-
Medium 6.5
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhausti…
-
Medium 6.5
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed…
-
Medium 5.3CVE-2024-28182 EPSS 82%
Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This cause…
-
Medium 4.4
c-ares out of bounds read in ares__read_line()
c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file.…
References
-
report
https://access.redhat.com/security/cve/CVE-2024-22025
-
report
https://access.redhat.com/security/cve/CVE-2024-25629
-
report
https://access.redhat.com/security/cve/CVE-2024-27982
-
report
https://access.redhat.com/security/cve/CVE-2024-27983
-
report
https://access.redhat.com/security/cve/CVE-2024-28182
-
report
https://bugzilla.redhat.com/2265713
-
report
https://bugzilla.redhat.com/2268639
-
report
https://bugzilla.redhat.com/2270559
-
report
https://bugzilla.redhat.com/2272764
-
report
https://bugzilla.redhat.com/2275392
-
advisory
https://errata.almalinux.org/8/ALSA-2024-2778.html