CVE-2021-22960

llhttp: HTTP Request Smuggling when parsing the body of chunked requests

The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Debian Llhttp Oracle and 1 more

Products

Debian Linux Llhttp Graalvm and 4 more

CVE-2021-22959

llhttp: HTTP Request Smuggling due to spaces in headers

The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Debian Llhttp Oracle and 1 more

Products

Debian Linux Llhttp Graalvm and 4 more

CVE-2021-22939

nodejs: Incomplete validation of tls rejectUnauthorized parameter

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

CVSS 3.1 · 5.3 Medium EPSS 14.7% KEV · Not listed

Vendors

Debian Netapp Nodejs and 3 more

Products

Debian Linux Nextgen Api Node.js and 8 more

CVE-2021-22940

nodejs: Use-after-free on close http2 on stream canceling

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

CVSS 3.1 · 7.5 High EPSS 13.9% KEV · Not listed

Vendors

Debian Netapp Nodejs and 3 more

Products

Debian Linux Nextgen Api Node.js and 7 more

CVE-2021-22931

nodejs: Improper handling of untypical characters in domain names

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

CVSS 3.1 · 9.8 Critical EPSS 22.0% KEV · Not listed

Vendors

Netapp Nodejs Oracle and 2 more

Products

Active Iq Unified Manager Nextgen Api Oncommand Insight and 10 more

CVE-2021-22918

libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

CVSS 3.1 · 5.3 Medium EPSS 23.1% KEV · Not listed

Vendors

Nodejs Redhat Siemens

Products

Node.js Enterprise Linux Rhel Eus and 2 more

CVE-2021-22930

nodejs: Use-after-free on close http2 on stream canceling

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

CVSS 3.1 · 9.8 Critical EPSS 36.5% KEV · Not listed

Vendors

Debian Netapp Nodejs and 2 more

Products

Debian Linux Nextgen Api Node.js and 4 more

CVE-2021-22884

nodejs: DNS rebinding in --inspect

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.

CVSS 3.1 · 7.5 High EPSS 36.8% KEV · Not listed

Vendors

Fedoraproject Netapp Nodejs and 3 more

Products

Fedora Active Iq Unified Manager E-series Performance Analyzer and 13 more

CVE-2021-22883

nodejs: HTTP2 'unknownProtocol' cause DoS by resource exhaustion

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

CVSS 3.1 · 7.5 High EPSS 77.4% KEV · Not listed

Vendors

Fedoraproject Netapp Nodejs and 3 more

Products

Fedora E-series Performance Analyzer Node.js and 9 more

CVE-2020-8287

nodejs: HTTP request smuggling via two copies of a header field in an http request

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

CVSS 3.1 · 6.5 Medium EPSS 16.3% KEV · Not listed

Vendors

Debian Fedoraproject Nodejs and 3 more

Products

Debian Linux Fedora Node.js and 4 more

CVE-2020-8265

nodejs: use-after-free in the TLS implementation

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.

CVSS 3.1 · 8.1 High EPSS 9.1% KEV · Not listed

Vendors

Debian Fedoraproject Nodejs and 3 more

Products

Debian Linux Fedora Node.js and 4 more

CVE-2020-8277

c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

CVSS 3.1 · 7.5 High EPSS 54.2% KEV · Not listed

Vendors

C-ares Project Fedoraproject Nodejs and 2 more

Products

C-ares Fedora Node.js and 7 more

CVE-2020-8252

libuv: buffer overflow in realpath

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Nodejs Opensuse and 1 more

Products

Fedora Node.js Leap and 3 more

CVE-2020-8201

nodejs: HTTP request smuggling due to CR-to-Hyphen conversion

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

CVSS 3.1 · 7.4 High EPSS 5.3% KEV · Not listed

Vendors

Fedoraproject Nodejs Opensuse and 1 more

Products

Fedora Node.js Leap and 3 more

CVE-2019-15606

nodejs: HTTP header values do not have trailing optional whitespace trimmed

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

CVSS 3.1 · 9.8 Critical EPSS 20.0% KEV · Not listed

Vendors

Debian Nodejs Opensuse and 2 more

Products

Debian Linux Node.js Leap and 6 more

CVE-2019-15605

nodejs: HTTP request smuggling using malformed Transfer-Encoding header

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

CVSS 3.1 · 9.8 Critical EPSS 57.1% KEV · Not listed

Vendors

Debian Fedoraproject Nodejs and 3 more

Products

Debian Linux Fedora Node.js and 13 more

CVE-2019-15604

nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

CVSS 3.1 · 7.5 High EPSS 20.0% KEV · Not listed

Vendors

Debian Nodejs Opensuse and 2 more

Products

Debian Linux Node.js Leap and 9 more

CVE-2023-23920

Node.js: insecure loading of ICU data through ICU_DATA environment variable

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Nodejs Redhat

Products

Debian Linux Node.js Enterprise Linux and 2 more

CVE-2022-43548

nodejs: DNS rebinding in inspect via invalid octal IP address

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

CVSS 3.1 · 8.1 High EPSS 14.9% KEV · Not listed

Vendors

Debian Nodejs Redhat

Products

Debian Linux Node.js Enterprise Linux and 2 more

CVE-2022-24999

express: "qs" prototype poisoning causes the hang of the node process

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

CVSS 3.1 · 7.5 High EPSS 15.7% KEV · Not listed

Vendors

Debian Openjsf Qs Project and 1 more

Products

Debian Linux Express Qs and 9 more