nodejs24 vulnerabilities (Red Hat)
113 vulnerabilities.
nodejs24Red HatA flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()`...1.8 Lownodejs24Red Hatundici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching3.7 Lownodejs24Red Hatundici vulnerable to HTTP response queue poisoning via keep-alive socket reuse3.7 Lownodejs24Red Hatundici vulnerable to HTTP header injection via Set-Cookie percent-decoding5.9 Mediumnodejs24Red Hatundici WebSocket client vulnerable to denial of service via fragment count bypass7.5 Highnodejs24Red Hatjs-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases5.3 Mediumnodejs24Red Hatmorgan vulnerable to Log Forging via unneutralized control characters in :remote-user5.3 Mediumnodejs24Red Hatip-address: XSS in Address6 HTML-emitting methods5.3 Mediumnodejs24Red Hatundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent7.4 Highnodejs24Red Hatundici vulnerable to cross-user information disclosure via shared cache whitespace bypass5.9 Mediumnodejs24Red Hatundici WebSocket client vulnerable to denial of service via cumulative fragment bypass7.5 Highnodejs24Red Hatundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse7.5 Highnodejs24Red Hatjs-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing7.5 Highnodejs24Red Hatjs-yaml: YAML merge-key chains can force quadratic CPU consumption5.3 Mediumnodejs24Red HatA flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket...3.3 Lownodejs24Red HatA flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was...3.3 Lownodejs24Red HatA flaw in Node.js TLS host verification can cause an attacker to bypass certification validation....4.3 Mediumnodejs24Red HatA flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt(...7.5 Highnodejs24Red HatA flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent...5.6 Mediumnodejs24Red HatA inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context...4.2 Mediumnodejs24Red HatA flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames,...5.3 Mediumnodejs24Red HatA flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead...7.7 Highnodejs24Red HatA flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL...5.9 Mediumnodejs24Red Hatbrace-expansion: Large numeric range defeats documented `max` DoS protection6.5 Mediumnodejs24Red HatA flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server...5.3 Mediumnodejs24Red HatA flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received...7.5 Highnodejs24Red HatA flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user...5.9 Mediumnodejs24Red HatA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream...5.3 Mediumnodejs24Red HatA flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()`...3.3 Lownodejs24Red HatAn incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the...3.3 Lownodejs24Red HatA flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric...5.9 Mediumnodejs24Red Hatnghttp2 Denial of service: Assertion failure due to the missing state validation7.5 Highnodejs24Red Hatundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation7.5 Highnodejs24Red Hatundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client7.5 Highnodejs24Red Hatundici is vulnerable to CRLF Injection via upgrade option4.6 Mediumnodejs24Red Hatundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS5.9 Mediumnodejs24Red Hatundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression7.5 Highnodejs24Red Hatundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')6.5 Mediumnodejs24Red Hatminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern8.7 Highnodejs24Red HatUncontrolled Resource Consumption in @isaacs/brace-expansion9.2 Criticalnodejs24Red HatA flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass...5.8 Mediumnodejs24Red HatA flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a...5.9 Mediumnodejs24Red HatWe have identified a bug in Node.js error handling where "Maximum call stack size exceeded"...5.9 Mediumnodejs24Red HatA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to...7.5 Highnodejs24Red HatA flaw in Node.js's permission model allows a file's access and modification timestamps to be...2.8 Lownodejs24Red HatA flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are...7.1 Highnodejs24Red HatA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow...7.1 Highnodejs24Red HatA flaw in Node.js URL processing causes an assertion failure in native code when `url.format()`...5.7 Mediumnodejs24Red HatA memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields...6.5 Medium