nodejs vulnerabilities (Ubuntu)
224 vulnerabilities.
nodejsUbuntuA flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass...5.8 MediumnodejsUbuntuA flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a...5.9 MediumnodejsUbuntuWe have identified a bug in Node.js error handling where "Maximum call stack size exceeded"...5.9 MediumnodejsUbuntuA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to...7.5 HighnodejsUbuntuA flaw in Node.js's permission model allows a file's access and modification timestamps to be...2.8 LownodejsUbuntuA flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are...7.1 HighnodejsUbuntuA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow...7.1 HighnodejsUbuntuOut-of-bounds read in HTTP client no_proxy handling5.9 MediumnodejsUbuntuTiming side-channel in SM2 algorithm on 64 bit ARM5.9 MediumnodejsUbuntuOut-of-bounds read & write in RFC 3211 KEK Unwrap9.8 CriticalnodejsUbuntuThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user...7.5 HighnodejsUbuntuCertain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary...6.5 MediumnodejsUbuntuA memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY...5.3 MediumnodejsUbuntuTiming side-channel in ECDSA signature computation4.6 MediumnodejsUbuntuLow-level invalid GF(2^m) parameters lead to OOB memory access8.8 HighnodejsUbuntuPossible denial of service in X.509 name checks7.5 HighnodejsUbuntuA vulnerability has been identified in Node.js, affecting users of the experimental permission...2.9 LownodejsUbuntuA security flaw in Node.js allows a bypass of network import restrictions. By embedding non...6.5 MediumnodejsUbuntuSSL_select_next_proto buffer overread9.1 CriticalnodejsUbuntuInsufficient user input filtering leads to arbitrary file read by non-authenticated attacker,...6.5 MediumnodejsUbuntuUse After Free with SSL_free_buffers9.8 CriticalnodejsUbuntuExcessive time spent checking DSA keys and parameters5.3 MediumnodejsUbuntuUnbounded memory growth with session handling in TLSv1.35.9 MediumnodejsUbuntuThe team has identified a critical vulnerability in the http server of the most recent version of...6.5 MediumnodejsUbuntuAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount...8.2 HighnodejsUbuntuA vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack...6.5 MediumnodejsUbuntuThe Node.js Permission Model does not clarify in the documentation that wildcards should be only...5.0 MediumnodejsUbuntuNode.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked...7.4 HighnodejsUbuntuPKCS12 Decoding crashes5.5 MediumnodejsUbuntuExcessive time spent checking invalid RSA public keys5.9 MediumnodejsUbuntuPOLY1305 MAC implementation corrupts vector registers on PowerPC6.5 MediumnodejsUbuntuExcessive time spent in DH check / generation with large Q parameter value5.3 MediumnodejsUbuntuIncorrect cipher key & IV length processing7.5 HighnodejsUbuntuMaliciously crafted export names in an imported WebAssembly module can inject JavaScript code....5.3 MediumnodejsUbuntuWhen the Node.js policy feature checks the integrity of a resource against a trusted manifest,...7.5 HighnodejsUbuntuA privilege escalation vulnerability exists in the experimental policy mechanism in all active...7.5 HighnodejsUbuntuThe use of `module.constructor.createRequire()` can bypass the policy mechanism and require...8.8 HighnodejsUbuntuThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the...9.8 CriticalnodejsUbuntuExcessive time spent checking DH q parameter value5.3 MediumnodejsUbuntuExcessive time spent checking DH keys and parameters5.3 MediumnodejsUbuntuAES-SIV implementation ignores empty associated data entries5.3 MediumnodejsUbuntuEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.5 HighnodejsUbuntuThe generateKeys() API function returned from crypto.createDiffieHellman() only generates missing...7.5 HighnodejsUbuntullhttp vulnerable to HTTP request smuggling7.5 HighnodejsUbuntuWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate...5.3 MediumnodejsUbuntuPossible DoS translating ASN.1 object identifiers6.5 MediumnodejsUbuntuInput buffer over-read in AES-XTS implementation on 64 bit ARM5.9 MediumnodejsUbuntuCertificate policy check not enabled5.3 MediumnodejsUbuntuInvalid certificate policies in leaf certificates are silently ignored5.3 MediumnodejsUbuntuExcessive Resource Usage Verifying X.509 Policy Constraints7.5 High- Show moreLoading…