High RLSA-2024:1687 7 CVEs

Important: nodejs:20 security update

Published May 6, 2024 · Updated Feb 4, 2026

Ecosystem: Rocky Linux

Summary

Node.js is a software development platform for building fast and scalable
network applications in the JavaScript programming language.

Security Fix(es):

* nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809)

* nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019)

* nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)

* nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)

* nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891)

* nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)

* nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)

Fixed packages 3

Release	Package	Fixed in
Rocky Linux · 8	nodejs	1:20.11.1-1.module+el8.9.0+1776+addd4aec
Rocky Linux · 8	nodejs-nodemon	0:3.0.1-1.module+el8.8.0+1459+02651ab6
Rocky Linux · 8	nodejs-packaging	0:2021.06-4.module+el8.7.0+1072+5b168780

Vulnerabilities 7

High 7.9

CVE-2024-21891

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be o…

Node.js node nodejs Azure Linux

Feb 20, 2024
High 7.9

CVE-2024-21896

The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the…

Node.js node nodejs Azure Linux

Feb 20, 2024
High 7.5

CVE-2024-21892

On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the pr…

Node.js node openjdk17 nodejs Debian Azure Linux Alpine Wolfi

Feb 20, 2024
High 7.5

CVE-2024-22019

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encodi…

Node.js node nodejs nodejs Debian Azure Linux Wolfi

Feb 20, 2024
High 7.4

CVE-2023-46809

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL wh…

Node.js node nodejs nodejs Debian Ubuntu Wolfi

Sep 7, 2024
High 7.3

CVE-2024-22017 Public exploit

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows t…

Node.js node nodejs libuv Azure Linux

Mar 19, 2024
Medium 5.0

CVE-2024-21890

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last chara…

Node.js node nodejs nodejs Ubuntu Azure Linux Wolfi

Feb 20, 2024

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=2264569
report
https://bugzilla.redhat.com/show_bug.cgi?id=2264574
report
https://bugzilla.redhat.com/show_bug.cgi?id=2264582
report
https://bugzilla.redhat.com/show_bug.cgi?id=2265717
report
https://bugzilla.redhat.com/show_bug.cgi?id=2265720
report
https://bugzilla.redhat.com/show_bug.cgi?id=2265722
report
https://bugzilla.redhat.com/show_bug.cgi?id=2265727