Summary
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)
* nghttp2: CONTINUATION frames DoS (CVE-2024-28182)
* nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service (CVE-2024-22025)
* nodejs: CONTINUATION frames DoS (CVE-2024-27983)
* nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | nodejs | 1:20.12.2-2.module+el8.9.0+1804+2708cc21 |
| Rocky Linux · 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 |
| Rocky Linux · 8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
Vulnerabilities 5
-
High 8.2
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packet…
-
Medium 6.5
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhausti…
-
Medium 6.5
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed…
-
Medium 5.3CVE-2024-28182 EPSS 82%
Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This cause…
-
Medium 4.4
c-ares out of bounds read in ares__read_line()
c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file.…