nodejs vulnerabilities (AlmaLinux)
175 vulnerabilities.
nodejsAlmaLinuxA flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent...5.6 MediumnodejsAlmaLinuxA inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context...4.2 MediumnodejsAlmaLinuxA flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames,...5.3 MediumnodejsAlmaLinuxA flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead...7.7 HighnodejsAlmaLinuxA flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL...5.9 MediumnodejsAlmaLinuxA flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server...5.3 MediumnodejsAlmaLinuxA flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received...7.5 HighnodejsAlmaLinuxA flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user...5.9 MediumnodejsAlmaLinuxA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream...5.3 MediumnodejsAlmaLinuxA flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()`...3.3 LownodejsAlmaLinuxAn incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the...3.3 LownodejsAlmaLinuxA flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric...5.9 MediumnodejsAlmaLinuxnghttp2 Denial of service: Assertion failure due to the missing state validation7.5 HighnodejsAlmaLinuxundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation7.5 HighnodejsAlmaLinuxundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client7.5 HighnodejsAlmaLinuxundici is vulnerable to CRLF Injection via upgrade option4.6 MediumnodejsAlmaLinuxundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS5.9 MediumnodejsAlmaLinuxundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression7.5 HighnodejsAlmaLinuxundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')6.5 MediumnodejsAlmaLinuxminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions7.5 HighnodejsAlmaLinuxminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern8.7 HighnodejsAlmaLinuxUncontrolled Resource Consumption in @isaacs/brace-expansion9.2 CriticalnodejsAlmaLinuxA flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a...5.9 MediumnodejsAlmaLinuxWe have identified a bug in Node.js error handling where "Maximum call stack size exceeded"...5.9 MediumnodejsAlmaLinuxA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to...7.5 HighnodejsAlmaLinuxA flaw in Node.js's permission model allows a file's access and modification timestamps to be...2.8 LownodejsAlmaLinuxA flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are...7.1 HighnodejsAlmaLinuxA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow...7.1 HighnodejsAlmaLinuxInteger Truncation on SQLite7.2 HighnodejsAlmaLinuxA flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX`...6.5 MediumnodejsAlmaLinuxThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user...7.5 HighnodejsAlmaLinuxIn Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in ...3.7 LownodejsAlmaLinuxAn integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated...6.9 MediumnodejsAlmaLinuxc-ares has a use-after-free in read_answers()8.3 HighnodejsAlmaLinuxA memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY...5.3 MediumnodejsAlmaLinuxWith the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker...7.7 HighnodejsAlmaLinuxUndici Uses Insufficiently Random Values6.8 MediumnodejsAlmaLinuxA vulnerability has been identified in Node.js, affecting users of the experimental permission...3.3 LownodejsAlmaLinuxA vulnerability has been identified in Node.js, affecting users of the experimental permission...2.9 LownodejsAlmaLinuxA security flaw in Node.js allows a bypass of network import restrictions. By embedding non...6.5 MediumnodejsAlmaLinuxThe team has identified a critical vulnerability in the http server of the most recent version of...6.5 MediumnodejsAlmaLinuxReading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage5.3 MediumnodejsAlmaLinuxAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount...8.2 HighnodejsAlmaLinuxnode-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation6.5 MediumnodejsAlmaLinuxc-ares out of bounds read in ares__read_line()4.4 MediumnodejsAlmaLinuxA vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack...6.5 MediumnodejsAlmaLinuxThe Node.js Permission Model does not clarify in the documentation that wildcards should be only...5.0 MediumnodejsAlmaLinuxNode.js depends on multiple built-in utility functions to normalize paths provided to node:fs...7.9 HighnodejsAlmaLinuxNode.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked...7.4 HighnodejsAlmaLinuxsetuid() does not affect libuv's internal io_uring operations if initialized before the call to...7.3 High- Show moreLoading…