Most recent entries from all

ALSA-2021:5171 — Moderate: nodejs:16 security, bug fix, and enhancement update

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.13.1), nodejs-nodemon (2.0.15). (BZ#2027610)

Security Fix(es):

* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

* normalize-url: ReDoS for data URLs (CVE-2021-33502)

* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-00256

certfr-2022-avi-494 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2022-avi-494

EUVD-2026-21083

fkie_cve-2021-3807

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

FSA-202302 — Festo: Several vulnerabilities in FactoryViews

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

GHSA-93q8-gq69-wqmw — Inefficient Regular Expression Complexity in chalk/ansi-regex

Affected: npm: ansi-regex

ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes.

**Proof of Concept** ```js import ansiRegex from 'ansi-regex'; for(var i = 1; i <= 50000; i++) { var time = Date.now(); var attack_str = "\u001B["+";".repeat(i*10000); ansiRegex().test(attack_str) var time_cost = Date.now() - time; console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms") } ``` The ReDOS is mainly due to the sub-patterns `[[\\]()#;?]*` and `(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*`

gsd-2021-3807

NCSC-2026-0034 — Kwetsbaarheden verholpen in Atlassian producten

NCSC-2026-0034

openSUSE-SU-2022:0657-1 — Security update for nodejs12

Security update for nodejs12

RHSA-2022:0041 — Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes nodejs-json-schema: Prototype pollution vulnerability llhttp: HTTP Request Smuggling due to spaces in headers llhttp: HTTP Request Smuggling when parsing the body of chunked requests nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite

SUSE-RU-2024:0511-1 — Recommended update for grafana

Recommended update for grafana

UBUNTU-CVE-2021-3807

Affected: Ubuntu:18.04:LTS: node-ansi-regex, Ubuntu:20.04:LTS: node-ansi-regex, Ubuntu:22.04:LTS: node-ansi-regex, Ubuntu:24.04:LTS: node-ansi-regex, Ubuntu:25.10: node-ansi-regex, Ubuntu:26.04:LTS: node-ansi-regex

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

WID-SEC-W-2022-0103 — Node.js: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen oder Code zur Ausführung zu bringen.