Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 296

Export CSV
CVE-2021-22884

nodejs: DNS rebinding in --inspect

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.

CVSS 3.1 · 7.5 High EPSS 36.8% KEV · Not listed
Vendors
Fedoraproject Netapp Nodejs and 3 more
Products
Fedora Active Iq Unified Manager E-series Performance Analyzer and 13 more
CVE-2021-22883

nodejs: HTTP2 'unknownProtocol' cause DoS by resource exhaustion

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

CVSS 3.1 · 7.5 High EPSS 77.4% KEV · Not listed
Vendors
Fedoraproject Netapp Nodejs and 3 more
Products
Fedora E-series Performance Analyzer Node.js and 9 more
CVE-2020-8287

nodejs: HTTP request smuggling via two copies of a header field in an http request

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

CVSS 3.1 · 6.5 Medium EPSS 16.3% KEV · Not listed
Vendors
Debian Fedoraproject Nodejs and 3 more
Products
Debian Linux Fedora Node.js and 4 more
CVE-2020-8265

nodejs: use-after-free in the TLS implementation

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.

CVSS 3.1 · 8.1 High EPSS 9.1% KEV · Not listed
Vendors
Debian Fedoraproject Nodejs and 3 more
Products
Debian Linux Fedora Node.js and 4 more
CVE-2020-8277

c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

CVSS 3.1 · 7.5 High EPSS 54.2% KEV · Not listed
Vendors
C-ares Project Fedoraproject Nodejs and 2 more
Products
C-ares Fedora Node.js and 7 more
CVE-2020-8252

libuv: buffer overflow in realpath

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Nodejs Opensuse and 1 more
Products
Fedora Node.js Leap and 3 more
CVE-2020-8251

nodejs: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests

Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.

CVSS 3.1 · 7.5 High EPSS 8.4% KEV · Not listed
Vendors
Fedoraproject Nodejs
Products
Fedora Node.js
CVE-2020-8201

nodejs: HTTP request smuggling due to CR-to-Hyphen conversion

Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.

CVSS 3.1 · 7.4 High EPSS 5.3% KEV · Not listed
Vendors
Fedoraproject Nodejs Opensuse and 1 more
Products
Fedora Node.js Leap and 3 more
CVE-2019-15606

nodejs: HTTP header values do not have trailing optional whitespace trimmed

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

CVSS 3.1 · 9.8 Critical EPSS 20.0% KEV · Not listed
Vendors
Debian Nodejs Opensuse and 2 more
Products
Debian Linux Node.js Leap and 6 more
CVE-2019-15605

nodejs: HTTP request smuggling using malformed Transfer-Encoding header

HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed

CVSS 3.1 · 9.8 Critical EPSS 57.1% KEV · Not listed
Vendors
Debian Fedoraproject Nodejs and 3 more
Products
Debian Linux Fedora Node.js and 13 more
CVE-2019-15604

nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

CVSS 3.1 · 7.5 High EPSS 20.0% KEV · Not listed
Vendors
Debian Nodejs Opensuse and 2 more
Products
Debian Linux Node.js Leap and 9 more
CVE-2023-23920

Node.js: insecure loading of ICU data through ICU_DATA environment variable

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Nodejs Redhat
Products
Debian Linux Node.js Enterprise Linux and 2 more
CVE-2023-23919

Node.js: OpenSSL error handling issues in nodejs crypto library

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Nodejs Redhat
Products
Node.js Enterprise Linux
CVE-2022-43548

nodejs: DNS rebinding in inspect via invalid octal IP address

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

CVSS 3.1 · 8.1 High EPSS 14.9% KEV · Not listed
Vendors
Debian Nodejs Redhat
Products
Debian Linux Node.js Enterprise Linux and 2 more
CVE-2022-35255

nodejs: weak randomness in WebCrypto keygen

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.

CVSS 3.1 · 9.1 Critical EPSS 2.1% KEV · Not listed
Vendors
Debian Nodejs Redhat and 1 more
Products
Debian Linux Node.js Enterprise Linux and 1 more
CVE-2022-36046

Unexpected server crash in Next.js version 12.2.3

Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting AND using next start or a [custom server](https://nextjs.org/docs/advanced-features/custom-server). Deployments on Vercel ([vercel.com](https://vercel.com/)) are not affected along with similar environments where `next-server` isn't being shared across requests.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Nodejs Vercel
Products
Node.js Next.js
CVE-2022-31150

CRLF injection in request headers

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue.

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Nodejs Redhat
Products
Undici Acm
CVE-2022-31151

Uncleared cookies on cross-host/cross-origin redirect in undici

Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site. This was patched in v5.7.1. By default, this vulnerability is not exploitable. Do not enable redirections, i.e. `maxRedirections: 0` (the default).

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Nodejs Redhat
Products
Undici Acm
CVE-2022-35949

`undici.request` vulnerable to SSRF using absolute URL on `pathname`

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request` call.

CVSS 3.1 · 5.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Nodejs Redhat
Products
Undici Acm
CVE-2022-35948

CRLF Injection in Nodejs ‘undici’ via Content-Type

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\r\n\r\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Nodejs Redhat
Products
Undici Acm