Node.js: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 10

• High 7.9
  CVE-2024-21891

  Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be o…

  Node.js node nodejs Azure Linux
  Feb 20, 2024
• High 7.9
  CVE-2024-21896

  The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the…

  Node.js node nodejs Azure Linux
  Feb 20, 2024
• High 7.5
  CVE-2024-21892

  On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the pr…

  Node.js node openjdk17 nodejs Debian Azure Linux Alpine Wolfi
  Feb 20, 2024
• High 7.5
  CVE-2024-22019

  A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encodi…

  Node.js node nodejs nodejs Debian Azure Linux Wolfi
  Feb 20, 2024
• High 7.4
  CVE-2023-46809

  Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL wh…

  Node.js node nodejs nodejs Debian Ubuntu Wolfi
  Sep 7, 2024
• High 7.3
  CVE-2024-22017 Public exploit

  setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows t…

  Node.js node nodejs libuv Azure Linux
  Mar 19, 2024
• High 7.3
  CVE-2024-24806

  Improper Domain Lookup that potentially leads to SSRF attacks in libuv

  libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. Th…

  libuv libuv nodejs cmake Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 7, 2024
• Medium 6.5
  CVE-2024-22025

  A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhausti…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Wolfi
  Mar 19, 2024
• Medium 5.0
  CVE-2024-21890

  The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last chara…

  Node.js node nodejs nodejs Ubuntu Azure Linux Wolfi
  Feb 20, 2024
• Low 3.9
  CVE-2024-24758

  Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici

  Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advis…

  Node.js undici nodejs node-undici Debian Ubuntu Azure Linux npm
  Feb 16, 2024

Revision history

1. 2026-09-28 #51

   Neue Updates von NetApp aufgenommen

2. 2025-11-11 #50

   Neue Updates von Rockwell Automation aufgenommen

3. 2025-08-31 #49

   Neue Updates von Debian aufgenommen

4. 2025-08-05 #48

   Neue Updates von F5 aufgenommen

5. 2025-05-14 #47

   Neue Updates von Gentoo aufgenommen

6. 2025-01-22 #46

   Neue Updates von Gentoo aufgenommen

7. 2024-12-17 #45

   Neue Updates von HITACHI aufgenommen

8. 2024-11-28 #44

   Neue Updates von SUSE aufgenommen

9. 2024-10-15 #43

   Neue Updates von Red Hat aufgenommen

10. 2024-10-07 #42

    Neue Updates von IBM aufgenommen

11. 2024-09-15 #41

    Neue Updates von Debian aufgenommen

12. 2024-07-31 #40

    Neue Updates von IBM aufgenommen

13. 2024-07-24 #39

    Neue Updates von Oracle Linux aufgenommen

14. 2024-07-23 #38

    Neue Updates von Red Hat aufgenommen

15. 2024-07-18 #37

    Neue Updates von Red Hat aufgenommen

16. 2024-07-16 #36

    Neue Updates von Red Hat aufgenommen

17. 2024-07-02 #35

    Neue Updates von Red Hat und Oracle Linux aufgenommen

18. 2024-06-16 #34

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

19. 2024-05-23 #33

    Neue Updates von IBM aufgenommen

20. 2024-05-20 #32

    Neue Updates von Red Hat aufgenommen

21. 2024-05-16 #31

    Neue Updates von Oracle Linux aufgenommen

22. 2024-05-15 #30

    Neue Updates von Red Hat aufgenommen

23. 2024-05-14 #29

    Neue Updates von Oracle Linux aufgenommen

24. 2024-05-13 #28

    Neue Updates von IBM aufgenommen

25. 2024-05-12 #27

    Neue Updates von IBM, Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

References

• Amazon Linux Security Advisory ALAS-2024-2474 vom 2024-03-05
  https://alas.aws.amazon.com/AL2/ALAS-2024-2474.html
• Debian Security Advisory DLA-3752 vom 2024-03-05
  https://lists.debian.org/debian-lts-announce/2024/03/msg00005.html
• IBM Security Bulletin 7129940 vom 2024-03-06
  https://www.ibm.com/support/pages/node/7129940
• NodeJS Security Releases vom 2024-02-14
  https://nodejs.org/en/blog/vulnerability/february-2024-security-releases
• NodeJS Release Notes vom 2024-02-14
  https://nodejs.org/en/blog/release/v18.19.1
• NodeJS Release Notes vom 2024-02-14
  https://nodejs.org/en/blog/release/v20.11.1
• NodeJS Release Notes vom 2024-02-14
  https://nodejs.org/en/blog/release/v21.6.2
• SUSE Security Update SUSE-SU-2024:0644-1 vom 2024-02-28
  https://lists.suse.com/pipermail/sle-security-updates/2024-February/018058.html
• Ubuntu Security Notice USN-6666-1 vom 2024-02-28
  https://ubuntu.com/security/notices/USN-6666-1
• SUSE Security Update SUSE-SU-2024:0643-1 vom 2024-02-28
  https://lists.suse.com/pipermail/sle-security-updates/2024-February/018059.html
• SUSE Security Update SUSE-SU-2024:0730-1 vom 2024-02-29
  https://lists.suse.com/pipermail/sle-security-updates/2024-February/018077.html
• SUSE Security Update SUSE-SU-2024:0730-1 vom 2024-02-29
  https://lists.suse.com/pipermail/sle-security-updates/2024-February/018078.html
• SUSE Security Update SUSE-SU-2024:0731-1 vom 2024-02-29
  https://lists.suse.com/pipermail/sle-security-updates/2024-February/018076.html
• SUSE Security Update SUSE-SU-2024:0733-1 vom 2024-02-29
  https://lists.suse.com/pipermail/sle-security-updates/2024-February/018074.html
• SUSE Security Update SUSE-SU-2024:0732-1 vom 2024-02-29
  https://lists.suse.com/pipermail/sle-security-updates/2024-February/018075.html
• SUSE Security Update SUSE-SU-2024:0728-1 vom 2024-03-01
  https://lists.suse.com/pipermail/sle-security-updates/2024-March/018084.html
• SUSE Security Update SUSE-SU-2024:0729-1 vom 2024-03-01
  https://lists.suse.com/pipermail/sle-security-updates/2024-March/018083.html
• IBM Security Bulletin 7129324 vom 2024-03-01
  https://www.ibm.com/support/pages/node/7129324
• Debian Security Advisory DSA-5638 vom 2024-03-10
  https://lists.debian.org/debian-security-announce/2024/msg00044.html
• Red Hat Security Advisory RHSA-2024:1354 vom 2024-03-18
  https://access.redhat.com/errata/RHSA-2024:1354
• Red Hat Security Advisory RHSA-2024:1424 vom 2024-03-19
  https://access.redhat.com/errata/RHSA-2024:1424
• Red Hat Security Advisory RHSA-2024:1438 vom 2024-03-20
  https://access.redhat.com/errata/RHSA-2024:1438
• Red Hat Security Advisory RHSA-2024:1444 vom 2024-03-20
  https://access.redhat.com/errata/RHSA-2024:1444
• Oracle Linux Security Advisory ELSA-2024-1438 vom 2024-03-21
  https://linux.oracle.com/errata/ELSA-2024-1438.html
• Oracle Linux Security Advisory ELSA-2024-1444 vom 2024-03-21
  https://linux.oracle.com/errata/ELSA-2024-1444.html
• Red Hat Security Advisory RHSA-2024:1503 vom 2024-03-25
  https://access.redhat.com/errata/RHSA-2024:1503
• Red Hat Security Advisory RHSA-2024:1510 vom 2024-03-26
  https://access.redhat.com/errata/RHSA-2024:1510
• Rocky Linux Security Advisory RLSA-2024:1503 vom 2024-03-27
  https://errata.build.resf.org/RLSA-2024:1503
• Oracle Linux Security Advisory ELSA-2024-1503 vom 2024-03-27
  https://linux.oracle.com/errata/ELSA-2024-1503.html
• Debian Security Advisory DLA-3776 vom 2024-03-27
  https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html
• Rocky Linux Security Advisory RLSA-2024:1510 vom 2024-03-27
  https://errata.build.resf.org/RLSA-2024:1510
• Rocky Linux Security Advisory RLSA-2024:1444 vom 2024-03-27
  https://errata.build.resf.org/RLSA-2024:1444
• Oracle Linux Security Advisory ELSA-2024-1510 vom 2024-03-27
  http://linux.oracle.com/errata/ELSA-2024-1510.html
• Oracle Linux Security Advisory ELSA-2024-1510 vom 2024-03-27
  https://linux.oracle.com/errata/ELSA-2024-1510.html
• IBM Security Bulletin 7145582 vom 2024-04-01
  https://www.ibm.com/support/pages/node/7145582
• Red Hat Security Advisory RHSA-2024:1678 vom 2024-04-04
  https://access.redhat.com/errata/RHSA-2024:1678
• Hitachi Vulnerability Information HITACHI-SEC-2024-150 vom 2024-12-17
  https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-150/index.html
• Red Hat Security Advisory RHSA-2024:1688 vom 2024-04-08
  https://access.redhat.com/errata/RHSA-2024:1688
• Red Hat Security Advisory RHSA-2024:1687 vom 2024-04-08
  https://access.redhat.com/errata/RHSA-2024:1687
• Oracle Linux Security Advisory ELSA-2024-1688 vom 2024-04-09
  https://linux.oracle.com/errata/ELSA-2024-1688.html
• Oracle Linux Security Advisory ELSA-2024-1687 vom 2024-04-09
  https://linux.oracle.com/errata/ELSA-2024-1687.html
• SUSE Security Update SUSE-SU-2024:1301-1 vom 2024-04-16
  https://lists.suse.com/pipermail/sle-security-updates/2024-April/018360.html
• SUSE Security Update SUSE-SU-2024:1309-1 vom 2024-04-16
  https://lists.suse.com/pipermail/sle-security-updates/2024-April/018363.html
• SUSE Security Update SUSE-SU-2024:1307-1 vom 2024-04-16
  https://lists.suse.com/pipermail/sle-security-updates/2024-April/018365.html
• Red Hat Security Advisory RHSA-2024:1880 vom 2024-04-18
  https://access.redhat.com/errata/RHSA-2024:1880
• Red Hat Security Advisory RHSA-2024:1932 vom 2024-04-22
  https://access.redhat.com/errata/RHSA-2024:1932
• Red Hat Security Advisory RHSA-2024:2651 vom 2024-05-02
  https://access.redhat.com/errata/RHSA-2024:2651
• Rocky Linux Security Advisory RLSA-2024:1687 vom 2024-05-06
  https://errata.build.resf.org/RLSA-2024:1687
• Rocky Linux Security Advisory RLSA-2024:1688 vom 2024-05-06
  https://errata.build.resf.org/RLSA-2024:1688
• Rocky Linux Security Advisory RLSA-2024:2778 vom 2024-05-09
  https://errata.build.resf.org/RLSA-2024:2778
• Red Hat Security Advisory RHSA-2024:2780 vom 2024-05-09
  https://access.redhat.com/errata/RHSA-2024:2780
• Rocky Linux Security Advisory RLSA-2024:2780 vom 2024-05-09
  https://errata.build.resf.org/RLSA-2024:2780
• Red Hat Security Advisory RHSA-2024:2778 vom 2024-05-09
  https://access.redhat.com/errata/RHSA-2024:2778
• Red Hat Security Advisory RHSA-2024:2793 vom 2024-05-09
  https://access.redhat.com/errata/RHSA-2024:2793
• Red Hat Security Advisory RHSA-2024:2779 vom 2024-05-09
  https://access.redhat.com/errata/RHSA-2024:2779
• Oracle Linux Security Advisory ELSA-2024-2778 vom 2024-05-09
  https://linux.oracle.com/errata/ELSA-2024-2778.html
• Rocky Linux Security Advisory RLSA-2024:2779 vom 2024-05-09
  https://errata.build.resf.org/RLSA-2024:2779
• IBM Security Bulletin 7150839 vom 2024-05-10
  https://www.ibm.com/support/pages/node/7150839
• Oracle Linux Security Advisory ELSA-2024-2780 vom 2024-05-10
  https://linux.oracle.com/errata/ELSA-2024-2780.html
• Rocky Linux Security Advisory RLSA-2024:1438 vom 2024-05-10
  https://errata.build.resf.org/RLSA-2024:1438
• IBM Security Bulletin 7151378 vom 2024-05-14
  https://www.ibm.com/support/pages/node/7151378
• Oracle Linux Security Advisory ELSA-2024-2779 vom 2024-05-15
  https://linux.oracle.com/errata/ELSA-2024-2779.html
• Red Hat Security Advisory RHSA-2024:2853 vom 2024-05-15
  https://access.redhat.com/errata/RHSA-2024:2853
• Oracle Linux Security Advisory ELSA-2024-2853 vom 2024-05-17
  https://linux.oracle.com/errata/ELSA-2024-2853.html
• Red Hat Security Advisory RHSA-2024:2910 vom 2024-05-20
  https://access.redhat.com/errata/RHSA-2024:2910
• IBM Security Bulletin 7149175 vom 2024-05-24
  https://www.ibm.com/support/pages/node/7149175
• Rocky Linux Security Advisory RLSA-2024:2910 vom 2024-06-14
  https://errata.build.resf.org/RLSA-2024:2910
• Rocky Linux Security Advisory RLSA-2024:2853 vom 2024-06-14
  https://errata.build.resf.org/RLSA-2024:2853
• Red Hat Security Advisory RHSA-2024:4247 vom 2024-07-03
  https://access.redhat.com/errata/RHSA-2024:4247
• Oracle Linux Security Advisory ELSA-2024-4247 vom 2024-07-03
  https://linux.oracle.com/errata/ELSA-2024-4247.html
• Red Hat Security Advisory RHSA-2024:4559 vom 2024-07-16
  https://access.redhat.com/errata/RHSA-2024:4559
• Red Hat Security Advisory RHSA-2024:4631 vom 2024-07-18
  https://access.redhat.com/errata/RHSA-2024:4631
• Red Hat Security Advisory RHSA-2024:4756 vom 2024-07-24
  https://access.redhat.com/errata/RHSA-2024:4756
• Red Hat Security Advisory RHSA-2024:4721 vom 2024-07-23
  https://access.redhat.com/errata/RHSA-2024:4721
• Oracle Linux Security Advisory ELSA-2024-4756 vom 2024-07-24
  https://linux.oracle.com/errata/ELSA-2024-4756.html
• IBM Security Bulletin 7162077 vom 2024-07-31
  https://www.ibm.com/support/pages/node/7162077
• Debian Security Advisory DLA-3886 vom 2024-09-14
  https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html
• IBM Security Bulletin 7172523 vom 2024-10-08
  https://www.ibm.com/support/pages/node/7172523
• Red Hat Security Advisory RHSA-2024:8132 vom 2024-10-15
  https://access.redhat.com/errata/RHSA-2024:8132
• SUSE Security Update SUSE-SU-2024:4109-1 vom 2024-11-28
  https://lists.suse.com/pipermail/sle-security-updates/2024-November/019873.html