nodejs vulnerabilities (AlmaLinux)
175 vulnerabilities.
nodejsAlmaLinuxThe permission model protects itself against path traversal attacks by calling path.resolve() on...7.9 HighnodejsAlmaLinuxA vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP...7.5 HighnodejsAlmaLinuxOn Linux, Node.js ignores certain environment variables if those may have been set by an...7.5 HighnodejsAlmaLinuxVarious `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In...9.8 CriticalnodejsAlmaLinuxA previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit...7.7 HighnodejsAlmaLinuxMaliciously crafted export names in an imported WebAssembly module can inject JavaScript code....5.3 MediumnodejsAlmaLinuxWhen the Node.js policy feature checks the integrity of a resource against a trusted manifest,...7.5 HighnodejsAlmaLinuxUndici's cookie header not cleared on cross-origin redirect in fetch3.9 LownodejsAlmaLinuxA privilege escalation vulnerability exists in the experimental policy mechanism in all active...7.5 HighnodejsAlmaLinuxThe use of `module.constructor.createRequire()` can bypass the policy mechanism and require...8.8 HighnodejsAlmaLinuxThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the...9.8 CriticalnodejsAlmaLinuxEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.5 HighnodejsAlmaLinuxThe generateKeys() API function returned from crypto.createDiffieHellman() only generates missing...7.5 HighnodejsAlmaLinuxllhttp vulnerable to HTTP request smuggling7.5 HighnodejsAlmaLinuxWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate...5.3 MediumnodejsAlmaLinuxThe use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism...7.5 HighnodejsAlmaLinuxsemver vulnerable to Regular Expression Denial of Service5.3 MediumnodejsAlmaLinux0-byte UDP payload DoS in c-ares7.5 HighnodejsAlmaLinuxInsufficient randomness in generation of DNS query IDs in c-ares5.9 MediumnodejsAlmaLinuxBuffer Underwrite in ares_inet_net_pton()4.1 MediumnodejsAlmaLinuxAutoTools does not set CARES_RANDOM_FILE during cross compilation3.7 LownodejsAlmaLinuxAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21...4.2 MediumnodejsAlmaLinuxA cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...7.5 HighnodejsAlmaLinuxA privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3...7.5 HighnodejsAlmaLinuxCRLF Injection in Nodejs ‘undici’ via host6.5 MediumnodejsAlmaLinuxUndici vulnerable to Regular Expression Denial of Service in Headers7.5 HighnodejsAlmaLinuxA flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the...8.6 HighnodejsAlmaLinuxhttp-cache-semantics vulnerable to Regular Expression Denial of Service5.3 MediumnodejsAlmaLinuxdecode-uri-component vulnerable to Denial of Service (DoS)7.5 HighnodejsAlmaLinuxqs vulnerable to Prototype Pollution7.5 HighnodejsAlmaLinuxA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19...8.1 HighnodejsAlmaLinuxminimatch ReDoS vulnerability7.5 HighnodejsAlmaLinuxA weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with...9.1 CriticalnodejsAlmaLinuxThe llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that...6.5 MediumnodejsAlmaLinuxglob-parent 6.0.0 vulnerable to Regular Expression Denial of Service7.5 HighnodejsAlmaLinuxThe llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line...6.5 MediumnodejsAlmaLinuxllhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields6.5 MediumnodejsAlmaLinuxllhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding6.5 MediumnodejsAlmaLinuxA OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due...8.1 HighnodejsAlmaLinuxGot allows a redirect to a UNIX socket5.3 MediumnodejsAlmaLinuxnpm packing does not respect root-level ignore files in workspaces7.5 HighnodejsAlmaLinuxPrototype Pollution in minimist9.8 CriticalnodejsAlmaLinuxDue to the formatting logic of the "console.table()" function it was not safe to allow user...8.2 HighnodejsAlmaLinuxModerate: nodejs:14 security update5.3 MediumnodejsAlmaLinuxNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...5.3 MediumnodejsAlmaLinuxAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...7.4 HighnodejsAlmaLinuxExposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch8.8 HighnodejsAlmaLinuxThe parser in accepts requests with a space (SP) right after the header name before the colon....6.5 MediumnodejsAlmaLinuxThe npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if...9.0 CriticalnodejsAlmaLinuxPrototype Pollution in kriszyp/json-schema9.8 Critical- Show moreLoading…