Skip to content
OpenAdvisories
High RHSA-2021:3639 11 CVEs

Red Hat Security Advisory: nodejs:12 security and bug fix update

Published Oct 21, 2024 · Updated Oct 14, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-debuginfo 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-debugsource 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-devel 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-docs 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-full-i18n 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-nodemon 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream nodejs-packaging 0:17-3.module+el8.1.0+3369+37ae6a45
Red Hat · RHEL 8.1 EUS rhel_eus:8.1::appstream npm 1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec

Vulnerabilities 11

  • High 8.2
    CVE-2021-32803

    Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

    The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a s…

    npm node-tar tar node-tar Debian Ubuntu npm
  • High 8.2
    CVE-2021-32804 Public exploit EPSS 15%

    Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

    The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning ab…

    npm node-tar tar node-tar Debian Ubuntu npm
  • High 7.5
    CVE-2021-27290

    Regular Expression Denial of Service (ReDoS)

    ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the stri…

    nodejs node-ssri ssri node-ssri Debian Ubuntu Alpine npm
  • Medium 5.3
    CVE-2021-23343

    Regular Expression Denial of Service (ReDoS)

    All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

    path-parse npm
  • Medium 5.3
    CVE-2021-23362

    Regular Expression Denial of Service (ReDoS)

    The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

    js-jquery hosted-git-info node-hosted-git-info node-hosted-git-info Debian Ubuntu Azure Linux npm
  • Unscored —
    CVE-2021-22918 EPSS 23%

    Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to conve…

    Node.js node nodejs pytorch Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2021-22930 EPSS 36%

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to…

    Node.js node nodejs nodejs Debian Azure Linux Alpine
  • Unscored —
    CVE-2021-22931 EPSS 22%

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to mis…

    Node.js node nodejs nodejs Azure Linux Alpine
  • Unscored —
    CVE-2021-22939 EPSS 15%

    If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2021-22940 EPSS 14%

    Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to…

    Node.js node nodejs nodejs Debian Azure Linux
  • Unscored —
    CVE-2021-3672

    A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name S…

    nodejs nodejs-current ceph c-ares Debian Ubuntu Azure Linux Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1941471
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1943208
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1956818
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1979338
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1988342
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1988394
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1990409
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1990415
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1993019
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1993029
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1993039
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1993929
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3639.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-3672
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3672
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3672
  • article
    https://c-ares.haxx.se/adv_20210810.html
  • report
    https://access.redhat.com/security/cve/CVE-2021-22918
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-22918
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-22918
  • article
    https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/
  • report
    https://access.redhat.com/security/cve/CVE-2021-22930
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-22930
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-22930
  • report
    https://access.redhat.com/security/cve/CVE-2021-22931
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-22931
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-22931
  • article
    https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
  • report
    https://access.redhat.com/security/cve/CVE-2021-22939
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-22939
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-22939
  • report
    https://access.redhat.com/security/cve/CVE-2021-22940
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-22940
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-22940
  • report
    https://access.redhat.com/security/cve/CVE-2021-23343
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-23343
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-23343
  • article
    https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067