134 results · Feed
-
High 7.1
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when usin…
-
Medium 5.9
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable w…
-
High 7.5
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unh…
-
Medium 5.9
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…
-
High 7.5
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when execut…
-
Low 3.7
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 pat…
-
Medium 5.3
A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Addition…
-
Medium 5.6
A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows envir…
-
High 7.7
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This …
-
Medium 6.8
Undici Uses Insufficiently Random Values
Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if s…
-
Medium 5.3
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be…
-
Low 3.3
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-f…
-
Low 2.9
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-f…
-
Medium 6.5
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URL…
-
Medium 6.5
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed…
-
High 8.2
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packet…
-
Unscored —
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can inte…
-
Low 3.9
Undici's cookie header not cleared on cross-origin redirect in fetch
Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disa…
-
High 7.5
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.…
-
Critical 9.8
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition f…
-
High 8.8
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the poli…
-
High 7.5
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not c…
-
High 7.5
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible t…
-
Medium 4.2
An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an…
-
Medium 6.5
CRLF Injection in Nodejs ‘undici’ via host
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize t…
-
High 7.5
Undici vulnerable to Regular Expression Denial of Service in Headers
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to th…
-
Critical 9.1
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in Secret…
-
Medium 6.5
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…
-
High 8.1CVE-2022-43548 EPSS 15%
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insuffi…
-
High 7.5
X.509 Email Address 4-byte Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the ap…
-
High 7.5
X.509 Email Address Variable Length Buffer Overflow
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an appli…
-
Critical 9.1CVE-2022-32214 EPSS 82%
llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
-
Critical 9.1CVE-2022-32213 EPSS 45%
llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
-
Unscored —CVE-2022-32215 EPSS 70%
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line …
-
Unscored —
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly…
-
Unscored —CVE-2021-44532 EPSS 10%
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It …
-
Unscored —
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN …
-
Unscored —CVE-2022-21824 EPSS 22%
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be pass…
-
Unscored —
A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name S…
-
Unscored —
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Re…