nodejs vulnerabilities (Red Hat)
203 vulnerabilities.
nodejsRed Hatundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation7.5 HighnodejsRed Hatundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client7.5 HighnodejsRed Hatundici is vulnerable to CRLF Injection via upgrade option4.6 MediumnodejsRed Hatundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS5.9 MediumnodejsRed Hatundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression7.5 HighnodejsRed Hatundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')6.5 MediumnodejsRed Hatminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions7.5 HighnodejsRed Hatminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern8.7 HighnodejsRed HatUncontrolled Resource Consumption in @isaacs/brace-expansion9.2 CriticalnodejsRed HatA flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a...5.9 MediumnodejsRed HatWe have identified a bug in Node.js error handling where "Maximum call stack size exceeded"...5.9 MediumnodejsRed HatA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to...7.5 HighnodejsRed HatA flaw in Node.js's permission model allows a file's access and modification timestamps to be...2.8 LownodejsRed HatA flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are...7.1 HighnodejsRed HatA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow...7.1 HighnodejsRed HatInteger Truncation on SQLite7.2 HighnodejsRed HatA flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX`...6.5 MediumnodejsRed HatThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user...7.5 HighnodejsRed HatIn Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in ...3.7 LownodejsRed HatAn integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated...6.9 MediumnodejsRed Hatc-ares has a use-after-free in read_answers()8.3 HighnodejsRed HatA memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY...5.3 MediumnodejsRed HatWith the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker...7.7 HighnodejsRed HatUndici Uses Insufficiently Random Values6.8 MediumnodejsRed HatA vulnerability has been identified in Node.js, affecting users of the experimental permission...3.3 LownodejsRed HatA vulnerability has been identified in Node.js, affecting users of the experimental permission...2.9 LownodejsRed HatA security flaw in Node.js allows a bypass of network import restrictions. By embedding non...6.5 MediumnodejsRed HatThe team has identified a critical vulnerability in the http server of the most recent version of...6.5 MediumnodejsRed HatReading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage5.3 MediumnodejsRed HatAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount...8.2 HighnodejsRed Hatnode-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation6.5 MediumnodejsRed Hatc-ares out of bounds read in ares__read_line()4.4 MediumnodejsRed HatA vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack...6.5 MediumnodejsRed HatThe Node.js Permission Model does not clarify in the documentation that wildcards should be only...5.0 MediumnodejsRed HatNode.js depends on multiple built-in utility functions to normalize paths provided to node:fs...7.9 HighnodejsRed HatNode.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked...7.4 HighnodejsRed Hatsetuid() does not affect libuv's internal io_uring operations if initialized before the call to...7.3 HighnodejsRed HatThe permission model protects itself against path traversal attacks by calling path.resolve() on...7.9 HighnodejsRed HatA vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP...7.5 HighnodejsRed HatOn Linux, Node.js ignores certain environment variables if those may have been set by an...7.5 HighnodejsRed HatVarious `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In...9.8 CriticalnodejsRed HatA previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit...7.7 HighnodejsRed HatMaliciously crafted export names in an imported WebAssembly module can inject JavaScript code....5.3 MediumnodejsRed HatWhen the Node.js policy feature checks the integrity of a resource against a trusted manifest,...7.5 HighnodejsRed HatUndici's cookie header not cleared on cross-origin redirect in fetch3.9 LownodejsRed HatA privilege escalation vulnerability exists in the experimental policy mechanism in all active...7.5 HighnodejsRed HatThe use of `module.constructor.createRequire()` can bypass the policy mechanism and require...8.8 HighnodejsRed HatThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the...9.8 CriticalnodejsRed HatEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.5 HighnodejsRed HatThe generateKeys() API function returned from crypto.createDiffieHellman() only generates missing...7.5 High- Show moreLoading…