Summary
nodejs
[1:24.14.1-2]
- Update bundled nghttp2 to 1.68.1
Related: RHEL-151374
[1:24.14.1-1]
- Update to 24.14.0
Resolves: RHEL-151374
nodejs-nodemon
[3.0.3-1]
- Initial import into nodejs:24 module
nodejs-packaging
[2021.06-6]
- Properly handle @group/package deps in nodejs-symlink-deps
Resolves: RHEL-121576
[2021.06-5]
- nodejs.req to properly detect bundled deps
[2021.06-4]
- NPM bundler: also find namespaced bundled dependencies
[2021.06-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
[2021.06-2]
- Fix hard-coded output directory in the bundler
[2021.06-1]
- Update to 2021.06-1
- bundler: Handle archaic license metadata
- bundler: Warn about bundled dependencies with no license metadata
[2021.01-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
[2021.01-2]
- nodejs-packaging-bundler improvements to handle uncommon characters
[2021.01]
- Add nodejs-packaging-bundler and update README.md
[2020.09-1]
- Move to dist-git as the upstream
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | nodejs | 1:24.14.1-2.module+el8.10.0+90873+35652ecc |
| Oracle Linux · 8 | nodejs-devel | 1:24.14.1-2.module+el8.10.0+90873+35652ecc |
| Oracle Linux · 8 | nodejs-docs | 1:24.14.1-2.module+el8.10.0+90873+35652ecc |
| Oracle Linux · 8 | nodejs-full-i18n | 1:24.14.1-2.module+el8.10.0+90873+35652ecc |
| Oracle Linux · 8 | nodejs-libs | 1:24.14.1-2.module+el8.10.0+90873+35652ecc |
| Oracle Linux · 8 | nodejs-nodemon | 0:3.0.3-1.module+el8.10.0+90873+35652ecc |
| Oracle Linux · 8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+90873+35652ecc |
| Oracle Linux · 8 | nodejs-packaging-bundler | 0:2021.06-6.module+el8.10.0+90873+35652ecc |
| Oracle Linux · 8 | npm | 1:11.11.0-1.24.14.1.2.module+el8.10.0+90873+35652ecc |
| Oracle Linux · 8 | v8-13.6-devel | 3:13.6.233.17-1.24.14.1.2.module+el8.10.0+90873+35652ecc |
Vulnerabilities 17
-
High 8.7
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed…
-
High 7.5
undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compres…
-
High 7.5
undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched in …
-
High 7.5
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `…
-
High 7.5
undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation
ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises sup…
-
High 7.5
nghttp2 Denial of service: Assertion failure due to the missing state validation
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2…
-
Medium 6.5
undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire. Wh…
-
Medium 5.9
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…
-
Medium 5.9
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, poten…
-
Medium 5.9CVE-2026-21717 Public exploit
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…
-
Medium 5.9
undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS
This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulnerable Undici versions, when interceptors.deduplicate() is enabled, response data for deduplicated requests could be accumulated in memory fo…
-
Medium 5.7
A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malfor…
-
Medium 5.3
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the re…
-
Medium 5.3
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) …
-
Medium 4.6
undici is vulnerable to CRLF Injection via upgrade option
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request prematurely and smuggle raw data to non-HTTP servic…
-
Low 3.3
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read p…
-
Low 3.3
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without t…