Most recent entries from all

ALSA-2020:0579 — Important: nodejs:10 security update

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

Security Fix(es):

* nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

* nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

* nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

* npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)

* npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

* npm: Global node_modules Binary Overwrite (CVE-2019-16777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2020-02545

Withdrawn: BELL-CVE-2019-15606 — CVE-2019-15606 does not affect BellSoft software

Withdrawn by the publisher.

Withdrawn: CLEANSTART-2026-BD71263 — Security fixes for CVE-2017-14919, CVE-2017-15896, CVE-2018-0734, CVE-2018-0735, CVE-2018-1000168, CVE-2018-12121, CVE-…

Withdrawn by the publisher.

Affected: CleanStart: nodejs

Multiple security vulnerabilities affect the nodejs package. These issues are resolved in later releases. See references for individual vulnerability details.

cnvd-2020-04541

EUVD-2026-236155

fkie_cve-2019-15606

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

GHSA-3qv8-368w-r69p

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

gsd-2019-15606

openSUSE-SU-2020:0293-1 — Security update for nodejs8

Security update for nodejs8

RHSA-2020:0573 — Red Hat Security Advisory: nodejs:10 security update

nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string nodejs: HTTP request smuggling using malformed Transfer-Encoding header nodejs: HTTP header values do not have trailing optional whitespace trimmed npm: Symlink reference outside of node_modules folder through the bin field upon installation npm: Arbitrary file write via constructed entry in the package.json bin field npm: Global node_modules Binary Overwrite

SUSE-SU-2020:0427-1 — Security update for nodejs10

Security update for nodejs10

UBUNTU-CVE-2019-15606

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

WID-SEC-W-2023-2389 — Node.js: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js und Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren und um Sicherheitsmechanismen zu umgehen.