69 results · Feed
-
Unscored —
The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. T…
-
Unscored —CVE-2021-22930 EPSS 36%
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to…
-
Unscored —CVE-2021-22931 EPSS 22%
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to mis…
-
Unscored —CVE-2021-22939 EPSS 15%
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no …
-
Unscored —CVE-2021-22883 EPSS 77%
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connect…
-
Unscored —CVE-2021-22884 EPSS 37%
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes …
-
Unscored —
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementat…
-
Unscored —
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for ex…
-
Unscored —
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denia…
-
Unscored —
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspe…
-
Unscored —
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can …
-
Unscored —
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
-
Unscored —
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
-
Low 3.7
Denial of service in nghttp2
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…
-
Unscored —CVE-2019-15606 EPSS 20%
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on h…
-
Unscored —CVE-2019-15604 EPSS 20%
Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 cert…
-
Unscored —
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
-
Unscored —
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker ca…
-
Unscored —CVE-2018-12121 EPSS 10%
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: B…
-
Unscored —
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascri…
-
Unscored —CVE-2018-12122 EPSS 41%
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacke…
-
Unscored —CVE-2018-0734 EPSS 12%
Timing attack against DSA
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affec…
-
Unscored —
Timing attack against ECDSA signature generation
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.…
-
Unscored —
The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) v…
-
Unscored —
The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such a…
-
Unscored —
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform rem…
-
Unscored —
Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill val…
-
Unscored —
Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake fa…
-
Unscored —
The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read m…