nodejs vulnerabilities (Red Hat)
203 vulnerabilities.
nodejsRed Hatllhttp vulnerable to HTTP request smuggling7.5 HighnodejsRed HatWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate...5.3 MediumnodejsRed HatThe use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism...7.5 HighnodejsRed Hatsemver vulnerable to Regular Expression Denial of Service5.3 MediumnodejsRed Hat0-byte UDP payload DoS in c-ares7.5 HighnodejsRed HatInsufficient randomness in generation of DNS query IDs in c-ares5.9 MediumnodejsRed HatBuffer Underwrite in ares_inet_net_pton()4.1 MediumnodejsRed HatAutoTools does not set CARES_RANDOM_FILE during cross compilation3.7 LownodejsRed HatAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21...4.2 MediumnodejsRed HatA cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...7.5 HighnodejsRed HatA privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3...7.5 HighnodejsRed HatCRLF Injection in Nodejs ‘undici’ via host6.5 MediumnodejsRed HatUndici vulnerable to Regular Expression Denial of Service in Headers7.5 HighnodejsRed HatA flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the...8.6 HighnodejsRed Hathttp-cache-semantics vulnerable to Regular Expression Denial of Service5.3 MediumnodejsRed Hatdecode-uri-component vulnerable to Denial of Service (DoS)7.5 HighnodejsRed Hatqs vulnerable to Prototype Pollution7.5 HighnodejsRed HatA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19...8.1 HighnodejsRed Hatminimatch ReDoS vulnerability7.5 HighnodejsRed HatA weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with...9.1 CriticalnodejsRed HatThe llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that...6.5 MediumnodejsRed Hatglob-parent 6.0.0 vulnerable to Regular Expression Denial of Service7.5 HighnodejsRed HatThe llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line...6.5 MediumnodejsRed Hatllhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields6.5 MediumnodejsRed Hatllhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding6.5 MediumnodejsRed HatA OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due...8.1 HighnodejsRed HatGot allows a redirect to a UNIX socket5.3 MediumnodejsRed Hatnpm packing does not respect root-level ignore files in workspaces7.5 HighnodejsRed HatPrototype Pollution in minimist9.8 CriticalnodejsRed HatDue to the formatting logic of the "console.table()" function it was not safe to allow user...8.2 HighnodejsRed HatModerate: nodejs:14 security update5.3 MediumnodejsRed HatNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...5.3 MediumnodejsRed HatAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...7.4 HighnodejsRed HatExposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch8.8 HighnodejsRed HatThe parser in accepts requests with a space (SP) right after the header name before the colon....6.5 MediumnodejsRed HatThe npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if...9.0 CriticalnodejsRed HatPrototype Pollution in kriszyp/json-schema9.8 CriticalnodejsRed HatThe parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body...6.5 MediumnodejsRed HatInefficient Regular Expression Complexity in chalk/ansi-regex7.5 HighnodejsRed HatArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links8.2 HighnodejsRed HatArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links8.2 HighnodejsRed HatNode.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an...7.5 HighnodejsRed HatIf the Node.js https API was used incorrectly and "undefined" was in passed for the ...5.3 MediumnodejsRed HatNode.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS,...9.8 CriticalnodejsRed HatA flaw was found in c-ares library, where a missing input validation check of host names returned...5.6 MediumnodejsRed HatUse After Free in node.js9.8 CriticalnodejsRed HatArbitrary File Creation/Overwrite due to insufficient absolute path sanitization8.2 HighnodejsRed HatArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning8.2 HighnodejsRed HatOut-of-Bounds Read in Node.js5.3 MediumnodejsRed HatRegular Expression Denial of Service (ReDoS)5.3 Medium- Show moreLoading…