Most recent entries from all

ALSA-2023:1582 — Moderate: nodejs:16 security, bug fix, and enhancement update

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1).

Security Fix(es):

* glob-parent: Regular Expression Denial of Service (CVE-2021-35065) * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904) * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881) * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918) * Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919) * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936) * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920) * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

certfr-2023-avi-0214 — De multiples vulnérabilités ont été découvertes dans IBM. Elles permettent à un attaquant d…

certfr-2023-avi-0214

Withdrawn: CLEANSTART-2026-AD27625 — Security fixes for CVE-2022-25881, CVE-2022-33987, CVE-2025-25285, CVE-2025-62718, CVE-2025-69873, CVE-2026-21637, CVE-…

Withdrawn by the publisher.

Affected: CleanStart: mongosh

Multiple security vulnerabilities affect the mongosh package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-225753

fkie_cve-2022-25881

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

GHSA-rc47-6667-2j5j — http-cache-semantics vulnerable to Regular Expression Denial of Service

Affected: npm: http-cache-semantics, Maven: org.webjars.npm:http-cache-semantics

http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

gsd-2022-25881

msrc_CVE-2022-25881 — This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious reques…

msrc_CVE-2022-25881

OESA-2023-1551 — nodejs security update

Affected: openEuler:20.03-LTS-SP1: nodejs, openEuler:20.03-LTS-SP3: nodejs, openEuler:22.03-LTS: nodejs, openEuler:22.03-LTS-SP1: nodejs, openEuler:22.03-LTS-SP2: nodejs

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library. (CVE-2022-25881) A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.(CVE-2022-32212) The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).(CVE-2022-32213) The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).(CVE-2022-32214) The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can…

openSUSE-SU-2024:12870-1 — corepack18-18.16.0-1.1 on GA media

corepack18-18.16.0-1.1 on GA media

RHSA-2023:1428 — Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.8 security and bug fix update

gin: Unsanitized input in the default logger in github.com/gin-gonic/gin express: "qs" prototype poisoning causes the hang of the node process http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability ua-parser-js: ReDoS vulnerability via the trim() function loader-utils: Regular expression denial of service decode-uri-component: improper input validation resulting in DoS json5: Prototype Pollution in JSON5 via Parse Method jszip: directory traversal via a crafted ZIP archive

SUSE-SU-2023:1871-1 — Security update for nodejs10

Security update for nodejs10

WID-SEC-W-2023-1103 — Red Hat OpenShift Multicluster Engine for Kubernetes: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift Multicluster Engine for Kubernetes ausnutzen, um einen Denial of Service Angriff durchzuführen.