Most recent entries from all

ALSA-2020:0579 — Important: nodejs:10 security update

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

Security Fix(es):

* nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

* nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

* nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

* npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)

* npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

* npm: Global node_modules Binary Overwrite (CVE-2019-16777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Withdrawn: BELL-CVE-2019-15604 — CVE-2019-15604 does not affect BellSoft software

Withdrawn by the publisher.

Withdrawn: CLEANSTART-2026-BD71263 — Security fixes for CVE-2017-14919, CVE-2017-15896, CVE-2018-0734, CVE-2018-0735, CVE-2018-1000168, CVE-2018-12121, CVE-…

Withdrawn by the publisher.

Affected: CleanStart: nodejs

Multiple security vulnerabilities affect the nodejs package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-236153

fkie_cve-2019-15604

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

GHSA-4p8g-wmmc-p9f7

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

gsd-2019-15604

openSUSE-SU-2020:0293-1 — Security update for nodejs8

Security update for nodejs8

RHSA-2020:0573 — Red Hat Security Advisory: nodejs:10 security update

nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string nodejs: HTTP request smuggling using malformed Transfer-Encoding header nodejs: HTTP header values do not have trailing optional whitespace trimmed npm: Symlink reference outside of node_modules folder through the bin field upon installation npm: Arbitrary file write via constructed entry in the package.json bin field npm: Global node_modules Binary Overwrite

SUSE-SU-2020:0427-1 — Security update for nodejs10

Security update for nodejs10

UBUNTU-CVE-2019-15604

Affected: Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs

Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate

WID-SEC-W-2023-2389 — Node.js: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js und Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren und um Sicherheitsmechanismen zu umgehen.