Most recent entries from all

ALSA-2024:5814 — Moderate: nodejs:20 security update

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: nodejs-packaging-bundler, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863) * nodejs: Bypass network import restriction via data URL (CVE-2024-22020) * nodejs: fs.lstat bypasses permission model (CVE-2024-22018) * nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-05685

BELL-CVE-2024-36137

Affected: Alpaquita:stream: nodejs, BellSoft Hardened Containers:stream: nodejs

BIT-node-2024-36137

Affected: Bitnami: node

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.

certfr-2024-avi-1103 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-1103

Withdrawn: CLEANSTART-2026-OL35355 — Security fixes in nodejs 20.15.1-r0

Withdrawn by the publisher.

Affected: CleanStart: nodejs

Package nodejs version 20.15.1-r0 fixes 3 vulnerabilities: CVE-2024-22018, CVE-2024-22020, CVE-2024-36137

EUVD-2026-236193

fkie_cve-2024-36137

GHSA-q793-mj5v-wh68

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.

Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.

msrc_CVE-2024-36137 — A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-f…

msrc_CVE-2024-36137

OESA-2025-1519 — nodejs security update

Affected: openEuler:24.03-LTS: nodejs

Node.js is an open-source, cross-platform, JavaScript runtime environment, it executes JavaScript code outside of a browser. Security Fix(es):

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.

Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.(CVE-2024-36137)

openSUSE-SU-2024:14214-1 — corepack20-20.15.1-1.1 on GA media

corepack20-20.15.1-1.1 on GA media

SUSE-SU-2024:2543-1 — Security update for nodejs20

Security update for nodejs20

Withdrawn: UBUNTU-CVE-2024-36137

Withdrawn by the publisher.

Affected: Ubuntu:25.04: nodejs

WID-SEC-W-2024-1548 — Node.js: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Code auszuführen oder um Sicherheitsmaßnahmen zu umgehen.