npm vulnerabilities (Red Hat)
197 vulnerabilities.
npmRed Hatundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation7.5 HighnpmRed Hatundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client7.5 HighnpmRed Hatundici is vulnerable to CRLF Injection via upgrade option4.6 MediumnpmRed Hatundici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS5.9 MediumnpmRed Hatundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression7.5 HighnpmRed Hatundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')6.5 MediumnpmRed Hatminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions7.5 HighnpmRed Hatminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern8.7 HighnpmRed HatUncontrolled Resource Consumption in @isaacs/brace-expansion9.2 CriticalnpmRed HatA flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a...5.9 MediumnpmRed HatWe have identified a bug in Node.js error handling where "Maximum call stack size exceeded"...5.9 MediumnpmRed HatA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to...7.5 HighnpmRed HatA flaw in Node.js's permission model allows a file's access and modification timestamps to be...2.8 LownpmRed HatA flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are...7.1 HighnpmRed HatA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow...7.1 HighnpmRed HatInteger Truncation on SQLite7.2 HighnpmRed HatA flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX`...6.5 MediumnpmRed HatThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user...7.5 HighnpmRed HatIn Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in ...3.7 LownpmRed HatAn integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated...6.9 MediumnpmRed Hatc-ares has a use-after-free in read_answers()8.3 HighnpmRed HatA memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY...5.3 MediumnpmRed HatWith the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker...7.7 HighnpmRed HatUndici Uses Insufficiently Random Values6.8 MediumnpmRed HatA vulnerability has been identified in Node.js, affecting users of the experimental permission...3.3 LownpmRed HatA vulnerability has been identified in Node.js, affecting users of the experimental permission...2.9 LownpmRed HatA security flaw in Node.js allows a bypass of network import restrictions. By embedding non...6.5 MediumnpmRed HatThe team has identified a critical vulnerability in the http server of the most recent version of...6.5 MediumnpmRed HatReading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage5.3 MediumnpmRed HatAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount...8.2 HighnpmRed Hatnode-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation6.5 MediumnpmRed Hatc-ares out of bounds read in ares__read_line()4.4 MediumnpmRed HatA vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack...6.5 MediumnpmRed HatThe Node.js Permission Model does not clarify in the documentation that wildcards should be only...5.0 MediumnpmRed HatNode.js depends on multiple built-in utility functions to normalize paths provided to node:fs...7.9 HighnpmRed HatNode.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked...7.4 HighnpmRed Hatsetuid() does not affect libuv's internal io_uring operations if initialized before the call to...7.3 HighnpmRed HatThe permission model protects itself against path traversal attacks by calling path.resolve() on...7.9 HighnpmRed HatA vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP...7.5 HighnpmRed HatOn Linux, Node.js ignores certain environment variables if those may have been set by an...7.5 HighnpmRed HatVarious `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In...9.8 CriticalnpmRed HatA previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit...7.7 HighnpmRed HatMaliciously crafted export names in an imported WebAssembly module can inject JavaScript code....5.3 MediumnpmRed HatWhen the Node.js policy feature checks the integrity of a resource against a trusted manifest,...7.5 HighnpmRed HatUndici's cookie header not cleared on cross-origin redirect in fetch3.9 LownpmRed HatA privilege escalation vulnerability exists in the experimental policy mechanism in all active...7.5 HighnpmRed HatThe use of `module.constructor.createRequire()` can bypass the policy mechanism and require...8.8 HighnpmRed HatThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the...9.8 CriticalnpmRed HatEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.5 HighnpmRed HatThe generateKeys() API function returned from crypto.createDiffieHellman() only generates missing...7.5 High- Show moreLoading…