nodejs vulnerabilities (Azure Linux)
142 vulnerabilities.
nodejsAzure LinuxNPM IP package incorrectly identifies some private IP addresses as public9.8 CriticalnodejsAzure LinuxImproper Domain Lookup that potentially leads to SSRF attacks in libuv7.3 HighnodejsAzure LinuxPKCS12 Decoding crashes5.5 MediumnodejsAzure LinuxExcessive time spent checking invalid RSA public keys5.9 MediumnodejsAzure LinuxJinja vulnerable to Cross-Site Scripting (XSS)5.4 MediumnodejsAzure LinuxPOLY1305 MAC implementation corrupts vector registers on PowerPC6.5 MediumnodejsAzure LinuxA privilege escalation vulnerability exists in the experimental policy mechanism in all active...7.5 HighnodejsAzure LinuxThe use of `module.constructor.createRequire()` can bypass the policy mechanism and require...8.8 HighnodejsAzure LinuxThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the...9.8 CriticalnodejsAzure LinuxEnvoy vulnerable to HTTP/2 memory leak in nghttp2 codec7.5 HighnodejsAzure Linuxllhttp vulnerable to HTTP request smuggling7.5 HighnodejsAzure Linuxsemver vulnerable to Regular Expression Denial of Service5.3 MediumnodejsAzure Linux0-byte UDP payload DoS in c-ares7.5 HighnodejsAzure LinuxInsufficient randomness in generation of DNS query IDs in c-ares5.9 MediumnodejsAzure LinuxBuffer Underwrite in ares_inet_net_pton()4.1 MediumnodejsAzure LinuxA cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...7.5 HighnodejsAzure LinuxA privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3...7.5 HighnodejsAzure LinuxCRLF Injection in Nodejs ‘undici’ via host6.5 MediumnodejsAzure LinuxUndici vulnerable to Regular Expression Denial of Service in Headers7.5 HighnodejsAzure LinuxA flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the...8.6 HighnodejsAzure Linuxhttp-cache-semantics vulnerable to Regular Expression Denial of Service5.3 MediumnodejsAzure LinuxA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19...8.1 HighnodejsAzure LinuxThe llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line...6.5 MediumnodejsAzure Linuxllhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields6.5 MediumnodejsAzure Linuxllhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding6.5 MediumnodejsAzure LinuxA OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due...8.1 HighnodejsAzure LinuxDue to the formatting logic of the "console.table()" function it was not safe to allow user...8.2 HighnodejsAzure LinuxModerate: nodejs:14 security update5.3 MediumnodejsAzure LinuxNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...5.3 MediumnodejsAzure LinuxAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...7.4 HighnodejsAzure LinuxNode.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an...7.5 HighnodejsAzure LinuxIf the Node.js https API was used incorrectly and "undefined" was in passed for the ...5.3 MediumnodejsAzure LinuxNode.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS,...9.8 CriticalnodejsAzure LinuxUse After Free in node.js9.8 CriticalnodejsAzure LinuxRegular Expression Denial of Service (ReDoS)5.3 MediumnodejsAzure LinuxJinja2 sandbox escape via string formatting8.6 High