nodejs-packaging vulnerabilities (AlmaLinux)
218 vulnerabilities.
nodejs-packagingAlmaLinuxThe permission model protects itself against path traversal attacks by calling path.resolve() on...7.9 Highnodejs-packagingAlmaLinuxA vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP...7.5 Highnodejs-packagingAlmaLinuxOn Linux, Node.js ignores certain environment variables if those may have been set by an...7.5 Highnodejs-packagingAlmaLinuxVarious `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In...9.8 Criticalnodejs-packagingAlmaLinuxA previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit...7.7 Highnodejs-packagingAlmaLinuxMaliciously crafted export names in an imported WebAssembly module can inject JavaScript code....5.3 Mediumnodejs-packagingAlmaLinuxWhen the Node.js policy feature checks the integrity of a resource against a trusted manifest,...7.5 Highnodejs-packagingAlmaLinuxUndici's cookie header not cleared on cross-origin redirect in fetch3.9 Lownodejs-packagingAlmaLinuxA privilege escalation vulnerability exists in the experimental policy mechanism in all active...7.5 Highnodejs-packagingAlmaLinuxThe use of `module.constructor.createRequire()` can bypass the policy mechanism and require...8.8 Highnodejs-packagingAlmaLinuxThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the...9.8 Criticalnodejs-packagingAlmaLinuxEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.5 Highnodejs-packagingAlmaLinuxThe generateKeys() API function returned from crypto.createDiffieHellman() only generates missing...7.5 Highnodejs-packagingAlmaLinuxllhttp vulnerable to HTTP request smuggling7.5 Highnodejs-packagingAlmaLinuxWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate...5.3 Mediumnodejs-packagingAlmaLinuxThe use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism...7.5 Highnodejs-packagingAlmaLinuxsemver vulnerable to Regular Expression Denial of Service5.3 Mediumnodejs-packagingAlmaLinux0-byte UDP payload DoS in c-ares7.5 Highnodejs-packagingAlmaLinuxInsufficient randomness in generation of DNS query IDs in c-ares5.9 Mediumnodejs-packagingAlmaLinuxBuffer Underwrite in ares_inet_net_pton()4.1 Mediumnodejs-packagingAlmaLinuxAutoTools does not set CARES_RANDOM_FILE during cross compilation3.7 Lownodejs-packagingAlmaLinuxAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21...4.2 Mediumnodejs-packagingAlmaLinuxA cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...7.5 Highnodejs-packagingAlmaLinuxA privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3...7.5 Highnodejs-packagingAlmaLinuxCRLF Injection in Nodejs ‘undici’ via host6.5 Mediumnodejs-packagingAlmaLinuxUndici vulnerable to Regular Expression Denial of Service in Headers7.5 Highnodejs-packagingAlmaLinuxA flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the...8.6 Highnodejs-packagingAlmaLinuxhttp-cache-semantics vulnerable to Regular Expression Denial of Service5.3 Mediumnodejs-packagingAlmaLinuxdecode-uri-component vulnerable to Denial of Service (DoS)7.5 Highnodejs-packagingAlmaLinuxqs vulnerable to Prototype Pollution7.5 Highnodejs-packagingAlmaLinuxA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19...8.1 Highnodejs-packagingAlmaLinuxminimatch ReDoS vulnerability7.5 Highnodejs-packagingAlmaLinuxA weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with...9.1 Criticalnodejs-packagingAlmaLinuxThe llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that...6.5 Mediumnodejs-packagingAlmaLinuxglob-parent 6.0.0 vulnerable to Regular Expression Denial of Service7.5 Highnodejs-packagingAlmaLinuxThe llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line...6.5 Mediumnodejs-packagingAlmaLinuxllhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields6.5 Mediumnodejs-packagingAlmaLinuxllhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding6.5 Mediumnodejs-packagingAlmaLinuxA OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due...8.1 Highnodejs-packagingAlmaLinuxGot allows a redirect to a UNIX socket5.3 Mediumnodejs-packagingAlmaLinuxPrototype Pollution in minimist9.8 Criticalnodejs-packagingAlmaLinuxDue to the formatting logic of the "console.table()" function it was not safe to allow user...8.2 Highnodejs-packagingAlmaLinuxModerate: nodejs:14 security update5.3 Mediumnodejs-packagingAlmaLinuxNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...5.3 Mediumnodejs-packagingAlmaLinuxAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...7.4 Highnodejs-packagingAlmaLinuxExposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch8.8 Highnodejs-packagingAlmaLinuxThe parser in accepts requests with a space (SP) right after the header name before the colon....6.5 Mediumnodejs-packagingAlmaLinuxThe npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if...9.0 Criticalnodejs-packagingAlmaLinuxPrototype Pollution in kriszyp/json-schema9.8 Criticalnodejs-packagingAlmaLinuxnew module: nodejs:16No score- Show moreLoading…