Node.js: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 6

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• High 7.7
  CVE-2023-39331

  A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traver…

  Node.js node nodejs-current nodejs-20 Alpine Wolfi
  Oct 18, 2023
• Medium 5.3
  CVE-2023-39333

  Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be…

  Node.js node nodejs nodejs Debian Ubuntu Alpine Wolfi
  Sep 7, 2024
• Low 3.9
  CVE-2023-45143

  Undici's cookie header not cleared on cross-origin redirect in fetch

  Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disa…

  Node.js undici nodejs openjdk21 Debian Ubuntu Azure Linux Alpine npm
  Oct 12, 2023
• Unscored —
  CVE-2023-38552

  When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can inte…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 18, 2023
• Unscored —
  CVE-2023-39332

  Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, …

  Node.js node nodejs-current nodejs-20 Alpine Wolfi
  Oct 18, 2023

Revision history

1. 2025-12-03 #25

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

2. 2025-05-14 #24

   Neue Updates von Gentoo aufgenommen

3. 2025-04-29 #23

   Neue Updates von Ubuntu aufgenommen

4. 2024-03-26 #22

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

5. 2024-03-21 #21

   Neue Updates von Oracle Linux aufgenommen

6. 2024-03-20 #20

   Neue Updates von Red Hat aufgenommen

7. 2024-03-03 #19

   Neue Updates von XEROX aufgenommen

8. 2024-02-04 #18

   Neue Updates von IBM aufgenommen

9. 2024-01-28 #17

   Neue Updates von Dell aufgenommen

10. 2024-01-18 #16

    Neue Updates von IBM aufgenommen

11. 2024-01-16 #15

    Neue Updates von IBM aufgenommen

12. 2023-12-27 #14

    Neue Updates von Debian aufgenommen

13. 2023-11-22 #13

    Neue Updates von Oracle Linux aufgenommen

14. 2023-11-14 #12

    Neue Updates von Red Hat aufgenommen

15. 2023-11-06 #11

    Neue Updates von SUSE aufgenommen

16. 2023-10-31 #10

    Neue Updates von SUSE aufgenommen

17. 2023-10-30 #9

    Neue Updates von SUSE aufgenommen

18. 2023-10-26 #8

    Neue Updates von SUSE aufgenommen

19. 2023-10-24 #7

    Neue Updates von Oracle Linux aufgenommen

20. 2023-10-23 #6

    Neue Updates von Oracle Linux und SUSE aufgenommen

21. 2023-10-22 #5

    Neue Updates von SUSE aufgenommen

22. 2023-10-19 #4

    Neue Updates von SUSE aufgenommen

23. 2023-10-18 #3

    Node.js LTS Version ergänzt

24. 2023-10-17 #2

    Neue Updates von Fedora und Red Hat aufgenommen

25. 2023-10-15 #1

    Initiale Fassung

References

• NodeJS Security Release vom 2023-10-13
  https://nodejs.org/en/blog/release/v20.8.1
• Fedora Security Advisory FEDORA-2023-4D2FD884EA vom 2023-10-17
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-4d2fd884ea
• Red Hat Security Advisory RHSA-2023:5764 vom 2023-10-17
  https://access.redhat.com/errata/RHSA-2023:5764
• Red Hat Security Advisory RHSA-2023:5765 vom 2023-10-17
  https://access.redhat.com/errata/RHSA-2023:5765
• Fedora Security Advisory FEDORA-2023-F66FC0F62A vom 2023-10-17
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-f66fc0f62a
• Fedora Security Advisory FEDORA-2023-E9C04D81C1 vom 2023-10-17
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-e9c04d81c1
• Fedora Security Advisory FEDORA-2023-DBE64661AF vom 2023-10-17
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-dbe64661af
• Fedora Security Advisory FEDORA-2023-D5030C983C vom 2023-10-17
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-d5030c983c
• Fedora Security Advisory FEDORA-2023-7B52921CAE vom 2023-10-17
  https://bodhi.fedoraproject.org/updates/FEDORA-2023-7b52921cae
• Node.js Friday October 13 2023 Security Releases vom 2023-10-13
  https://nodejs.org/en/blog/vulnerability/october-2023-security-releases
• Red Hat Security Advisory RHSA-2023:5869 vom 2023-10-19
  https://access.redhat.com/errata/RHSA-2023:5869.html
• Jenkins Security Advisory 2023-10-18
  https://www.jenkins.io/security/advisory/2023-10-18/
• Red Hat Security Advisory RHSA-2023:5850 vom 2023-10-19
  https://access.redhat.com/errata/RHSA-2023:5850
• Red Hat Security Advisory RHSA-2023:5849 vom 2023-10-19
  https://access.redhat.com/errata/RHSA-2023:5849
• SUSE Security Update SUSE-SU-2023:4132-1 vom 2023-10-19
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016755.html
• SUSE Security Update SUSE-SU-2023:4133-1 vom 2023-10-19
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016754.html
• SUSE Security Update SUSE-SU-2023:4150-1 vom 2023-10-20
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016768.html
• Oracle Linux Security Advisory ELSA-2023-5869 vom 2023-10-23
  https://linux.oracle.com/errata/ELSA-2023-5869.html
• SUSE Security Update SUSE-SU-2023:4155-1 vom 2023-10-23
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016810.html
• Oracle Linux Security Advisory ELSA-2023-5849 vom 2023-10-24
  http://linux.oracle.com/errata/ELSA-2023-5849.html
• Oracle Linux Security Advisory ELSA-2023-5850 vom 2023-10-24
  http://linux.oracle.com/errata/ELSA-2023-5850.html
• Oracle Linux Security Advisory ELSA-2023-5765 vom 2023-10-24
  http://linux.oracle.com/errata/ELSA-2023-5765.html
• SUSE Security Update SUSE-SU-2023:4207-1 vom 2023-10-26
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016859.html
• SUSE Security Update SUSE-SU-2023:4259-1 vom 2023-10-30
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016918.html
• SUSE Security Update SUSE-SU-2023:4295-1 vom 2023-10-31
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016945.html
• SUSE Security Update SUSE-SU-2023:4374-1 vom 2023-11-06
  https://lists.suse.com/pipermail/sle-security-updates/2023-November/016996.html
• SUSE Security Update SUSE-SU-2023:4373-1 vom 2023-11-06
  https://lists.suse.com/pipermail/sle-security-updates/2023-November/016997.html
• Red Hat Security Advisory RHSA-2023:7205 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:7205
• Oracle Linux Security Advisory ELSA-2023-7205 vom 2023-11-23
  https://linux.oracle.com/errata/ELSA-2023-7205.html
• Debian Security Advisory DSA-5589 vom 2023-12-28
  https://lists.debian.org/debian-security-announce/2023/msg00286.html
• IBM Security Bulletin 7108595 vom 2024-01-17
  https://www.ibm.com/support/pages/node/7108595
• IBM Security Bulletin 7108824 vom 2024-01-18
  https://www.ibm.com/support/pages/node/7108824
• DELL Security Update
  https://www.dell.com/support/kbdoc/de-de/000221476/dsa-2024-058-security-update-for-dell-networker-vproxy-multiple-components-vulnerabilities
• IBM Security Bulletin 7114471 vom 2024-02-02
  https://www.ibm.com/support/pages/node/7114471
• XEROX Security Advisory XRX24-004 vom 2024-03-04
  https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox%C2%AE-Security-Bulletin-XRX24-004-Xerox%C2%AE-FreeFlow%C2%AE-Print-Server-v7.pdf
• XEROX Security Advisory XRX24-005 vom 2024-03-04
  https://security.business.xerox.com/wp-content/uploads/2024/03/Xerox-Security-Bulletin-XRX24-005-Xerox-FreeFlow%C2%AE-Print-Server-v9_Feb-2024.pdf
• Red Hat Security Advisory RHSA-2024:1444 vom 2024-03-20
  https://access.redhat.com/errata/RHSA-2024:1444
• Oracle Linux Security Advisory ELSA-2024-1444 vom 2024-03-21
  https://linux.oracle.com/errata/ELSA-2024-1444.html
• Rocky Linux Security Advisory RLSA-2024:1444 vom 2024-03-27
  https://errata.build.resf.org/RLSA-2024:1444
• Ubuntu Security Notice USN-7469-3 vom 2025-04-29
  https://ubuntu.com/security/notices/USN-7469-3
• Gentoo Linux Security Advisory GLSA-202505-11 vom 2025-05-14
  https://security.gentoo.org/glsa/202505-11
• Rocky Linux Security Advisory RLSA-2023:5869 vom 2025-12-04
  https://errata.build.resf.org/RLSA-2023:5869
• Rocky Linux Security Advisory RLSA-2023:5849 vom 2025-12-04
  https://errata.build.resf.org/RLSA-2023:5849