nodejs - security update

Fixed packages 1

Vulnerabilities 7

• Critical 9.1
  CVE-2022-32213 EPSS 45%

  llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine npm
  Jul 14, 2022
• Critical 9.1
  CVE-2022-32214 EPSS 82%

  llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine npm
  Jul 14, 2022
• Critical 9.1
  CVE-2022-35255

  A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in Secret…

  Node.js node nodejs nodejs Debian Alpine
  Dec 5, 2022
• High 8.1
  CVE-2022-43548 EPSS 15%

  A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insuffi…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Dec 5, 2022
• Medium 6.5
  CVE-2022-35256

  The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine Wolfi
  Dec 5, 2022
• Unscored —
  CVE-2022-32212

  A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAl…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  Jul 14, 2022
• Unscored —
  CVE-2022-32215 EPSS 70%

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line …

  Node.js node nodejs rust Debian Ubuntu Azure Linux Alpine
  Jul 14, 2022