nodejs vulnerabilities (Debian)
142 vulnerabilities.
nodejsDebianA security flaw in Node.js allows a bypass of network import restrictions. By embedding non...6.5 MediumnodejsDebianThe team has identified a critical vulnerability in the http server of the most recent version of...6.5 MediumnodejsDebianAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount...8.2 HighnodejsDebianA vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack...6.5 MediumnodejsDebianNode.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked...7.4 HighnodejsDebianA vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP...7.5 HighnodejsDebianOn Linux, Node.js ignores certain environment variables if those may have been set by an...7.5 HighnodejsDebianMaliciously crafted export names in an imported WebAssembly module can inject JavaScript code....5.3 MediumnodejsDebianWhen the Node.js policy feature checks the integrity of a resource against a trusted manifest,...7.5 HighnodejsDebianA privilege escalation vulnerability exists in the experimental policy mechanism in all active...7.5 HighnodejsDebianThe use of `module.constructor.createRequire()` can bypass the policy mechanism and require...8.8 HighnodejsDebianThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the...9.8 CriticalnodejsDebianThe generateKeys() API function returned from crypto.createDiffieHellman() only generates missing...7.5 HighnodejsDebianllhttp vulnerable to HTTP request smuggling7.5 HighnodejsDebianWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate...5.3 MediumnodejsDebianThe use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism...7.5 HighnodejsDebianAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21...4.2 MediumnodejsDebianA cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...7.5 HighnodejsDebianA privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3...7.5 HighnodejsDebianA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19...8.1 HighnodejsDebianA weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with...9.1 CriticalnodejsDebianThe llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that...6.5 MediumnodejsDebianThe llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line...6.5 MediumnodejsDebianllhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields6.5 MediumnodejsDebianllhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding6.5 MediumnodejsDebianA OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due...8.1 HighnodejsDebianDue to the formatting logic of the "console.table()" function it was not safe to allow user...8.2 HighnodejsDebianModerate: nodejs:14 security update5.3 MediumnodejsDebianNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...5.3 MediumnodejsDebianAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...7.4 HighnodejsDebianThe parser in accepts requests with a space (SP) right after the header name before the colon....6.5 MediumnodejsDebianThe parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body...6.5 MediumnodejsDebianNode.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an...7.5 HighnodejsDebianIf the Node.js https API was used incorrectly and "undefined" was in passed for the ...5.3 MediumnodejsDebianUse After Free in node.js9.8 CriticalnodejsDebianNode.js bad7.5 HighnodejsDebianNode.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack...7.5 HighnodejsDebianNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in...6.5 MediumnodejsDebianNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug...8.1 HighnodejsDebianNode.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver...7.4 HighnodejsDebiannapi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0,...8.1 HighnodejsDebianDenial of service in nghttp23.7 LownodejsDebianThe uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does...8.1 HighnodejsDebianIncluding trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of...9.8 CriticalnodejsDebianImproper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when...7.5 HighnodejsDebianHTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer...9.8 CriticalnodejsDebianSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service7.5 HighnodejsDebianSome HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service7.5 HighnodejsDebianSome HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service7.5 HighnodejsDebianKeep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js...7.5 High- Show moreLoading…