nodejs vulnerabilities (Alpine)
149 vulnerabilities.
nodejsAlpineA vulnerability has been identified in Node.js, affecting users of the experimental permission...2.9 LownodejsAlpineA security flaw in Node.js allows a bypass of network import restrictions. By embedding non...6.5 MediumnodejsAlpineThe team has identified a critical vulnerability in the http server of the most recent version of...6.5 MediumnodejsAlpineAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount...8.2 HighnodejsAlpineMaliciously crafted export names in an imported WebAssembly module can inject JavaScript code....5.3 MediumnodejsAlpineWhen the Node.js policy feature checks the integrity of a resource against a trusted manifest,...7.5 HighnodejsAlpineUndici's cookie header not cleared on cross-origin redirect in fetch3.9 LownodejsAlpineA privilege escalation vulnerability exists in the experimental policy mechanism in all active...7.5 HighnodejsAlpineThe use of `module.constructor.createRequire()` can bypass the policy mechanism and require...8.8 HighnodejsAlpineThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the...9.8 CriticalnodejsAlpineAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21...4.2 MediumnodejsAlpineA cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...7.5 HighnodejsAlpineA privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3...7.5 HighnodejsAlpineCRLF Injection in Nodejs ‘undici’ via host6.5 MediumnodejsAlpineUndici vulnerable to Regular Expression Denial of Service in Headers7.5 HighnodejsAlpineA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19...8.1 HighnodejsAlpineX.509 Email Address Variable Length Buffer Overflow7.5 HighnodejsAlpineX.509 Email Address 4-byte Buffer Overflow7.5 HighnodejsAlpineA weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with...9.1 CriticalnodejsAlpineThe llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that...6.5 MediumnodejsAlpineThe llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line...6.5 MediumnodejsAlpinellhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields6.5 MediumnodejsAlpinellhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding6.5 MediumnodejsAlpineDue to the formatting logic of the "console.table()" function it was not safe to allow user...8.2 HighnodejsAlpineModerate: nodejs:14 security update5.3 MediumnodejsAlpineNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...5.3 MediumnodejsAlpineAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...7.4 HighnodejsAlpineThe parser in accepts requests with a space (SP) right after the header name before the colon....6.5 MediumnodejsAlpineThe parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body...6.5 MediumnodejsAlpineArbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization8.2 HighnodejsAlpineUNIX Symbolic Link (Symlink) Following in @npmcli/arborist8.2 HighnodejsAlpineUNIX Symbolic Link (Symlink) Following in @npmcli/arborist8.2 HighnodejsAlpineArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links8.2 HighnodejsAlpineArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links8.2 HighnodejsAlpineIf the Node.js https API was used incorrectly and "undefined" was in passed for the ...5.3 MediumnodejsAlpineNode.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS,...9.8 CriticalnodejsAlpineA flaw was found in c-ares library, where a missing input validation check of host names returned...5.6 MediumnodejsAlpineUse After Free in node.js9.8 CriticalnodejsAlpineOut-of-Bounds Read in Node.js5.3 MediumnodejsAlpineRegular Expression Denial of Service (ReDoS)7.5 HighnodejsAlpineNode.js bad7.5 HighnodejsAlpineNode.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack...7.5 HighnodejsAlpineHeap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to...8.8 HighnodejsAlpineNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in...6.5 MediumnodejsAlpineNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug...8.1 HighnodejsAlpineUncontrolled Resource Consumption in node7.5 HighnodejsAlpinePrototype Pollution7.3 HighnodejsAlpineNode.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver...7.4 HighnodejsAlpineThe implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js...7.8 HighnodejsAlpineTLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and ...7.4 High- Show moreLoading…