Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 11 | nodejs | 12.22.12~dfsg-1~deb11u5 |
Vulnerabilities 8
-
High 8.2
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packet…
-
High 7.5
llhttp vulnerable to HTTP request smuggling
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…
-
High 7.5
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.…
-
High 7.5
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encodi…
-
High 7.4
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL wh…
-
Medium 6.5
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhausti…
-
Medium 6.5
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed…
-
Unscored —
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, t…