nodejs vulnerabilities (Mageia)
139 vulnerabilities.
nodejsMageiaWhen the Node.js policy feature checks the integrity of a resource against a trusted manifest,...7.5 HighnodejsMageiaUndici's cookie header not cleared on cross-origin redirect in fetch3.9 LownodejsMageiaA privilege escalation vulnerability exists in the experimental policy mechanism in all active...7.5 HighnodejsMageiaThe use of `module.constructor.createRequire()` can bypass the policy mechanism and require...8.8 HighnodejsMageiaThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the...9.8 CriticalnodejsMageiaEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.5 HighnodejsMageiaA vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental...7.5 HighnodejsMageiaA vulnerability has been discovered in Node.js version 20, specifically within the experimental...7.7 HighnodejsMageiafs.openAsBlob() can bypass the experimental permission model when using the file system read...7.5 HighnodejsMageiaA vulnerability has been identified in Node.js version 20, affecting users of the experimental...5.3 MediumnodejsMageiaA privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL...7.5 HighnodejsMageiaThe generateKeys() API function returned from crypto.createDiffieHellman() only generates missing...7.5 HighnodejsMageiallhttp vulnerable to HTTP request smuggling7.5 HighnodejsMageiaWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate...5.3 MediumnodejsMageiaA vulnerability has been identified in the Node.js (.msi version) installation process,...7.5 HighnodejsMageiaThe use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism...7.5 HighnodejsMageiaAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21...4.2 MediumnodejsMageiaA privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3...7.5 HighnodejsMageiaA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19...8.1 HighnodejsMageiaThe llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that...6.5 MediumnodejsMageiaA cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0...5.3 MediumnodejsMageiaThe llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line...6.5 MediumnodejsMageiallhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields6.5 MediumnodejsMageiallhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding6.5 MediumnodejsMageiaA OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due...8.1 HighnodejsMageiaDue to the formatting logic of the "console.table()" function it was not safe to allow user...8.2 HighnodejsMageiaModerate: nodejs:14 security update5.3 MediumnodejsMageiaNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...5.3 MediumnodejsMageiaAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...7.4 HighnodejsMageiaThe parser in accepts requests with a space (SP) right after the header name before the colon....6.5 MediumnodejsMageiaThe npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if...9.0 CriticalnodejsMageiaThe parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body...6.5 MediumnodejsMageiaArbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization8.2 HighnodejsMageiaUNIX Symbolic Link (Symlink) Following in @npmcli/arborist8.2 HighnodejsMageiaUNIX Symbolic Link (Symlink) Following in @npmcli/arborist8.2 HighnodejsMageiaArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links8.2 HighnodejsMageiaArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links8.2 HighnodejsMageiaNode.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an...7.5 HighnodejsMageiaIf the Node.js https API was used incorrectly and "undefined" was in passed for the ...5.3 MediumnodejsMageiaNode.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS,...9.8 CriticalnodejsMageiaA flaw was found in c-ares library, where a missing input validation check of host names returned...5.6 MediumnodejsMageiaUse After Free in node.js9.8 CriticalnodejsMageiaRegular Expression Denial of Service (ReDoS)5.3 MediumnodejsMageiaRegular Expression Denial of Service (ReDoS)7.5 HighnodejsMageiaNode.js bad7.5 HighnodejsMageiaNode.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack...7.5 HighnodejsMageiaNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in...6.5 MediumnodejsMageiaNode.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug...8.1 HighnodejsMageiaPrototype Pollution7.3 HighnodejsMageiaThe implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js...7.8 High- Show moreLoading…