nodejs - security update

Fixed packages 1

Vulnerabilities 6

• High 7.5
  CVE-2019-9511 Public exploit EPSS 60%

  Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

  Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manip…

  nodejs nodejs nodejs nginx Debian Ubuntu Alpine
  Aug 13, 2019
• High 7.5
  CVE-2019-9513 Public exploit EPSS 82%

  Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

  Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority…

  nodejs nodejs nodejs nginx Debian Ubuntu Alpine
  Aug 13, 2019
• High 7.5
  CVE-2019-9514 EPSS 83%

  Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

  Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depe…

  nodejs go nodejs golang-1.8 Debian Ubuntu Azure Linux Alpine
  Aug 13, 2019
• Unscored —
  CVE-2019-15604 EPSS 20%

  Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 cert…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Feb 7, 2020
• Unscored —
  CVE-2019-15605 Public exploit EPSS 57%

  HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Feb 7, 2020
• Unscored —
  CVE-2019-15606 EPSS 20%

  Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on h…

  Node.js node nodejs nodejs Debian Ubuntu Alpine
  Feb 7, 2020