Vulnerabilities (CVE)

Filtered by vendor Nodejs Subscribe
Filtered by product Node.js
Total 72 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-8287 4 Debian, Fedoraproject, Nodejs and 1 more 4 Debian Linux, Fedora, Node.js and 1 more 2021-02-19 6.4 MEDIUM 6.5 MEDIUM
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
CVE-2020-8265 4 Debian, Fedoraproject, Nodejs and 1 more 4 Debian Linux, Fedora, Node.js and 1 more 2021-02-19 6.8 MEDIUM 8.1 HIGH
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.
CVE-2018-21270 1 Nodejs 1 Node.js 2021-02-16 5.8 MEDIUM 6.5 MEDIUM
Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).
CVE-2020-8201 2 Nodejs, Opensuse 2 Node.js, Leap 2021-01-11 5.8 MEDIUM 7.4 HIGH
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
CVE-2020-8251 1 Nodejs 1 Node.js 2021-01-11 5.0 MEDIUM 7.5 HIGH
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
CVE-2020-8252 2 Nodejs, Opensuse 2 Node.js, Leap 2020-12-13 4.6 MEDIUM 7.8 HIGH
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
CVE-2019-5739 2 Nodejs, Opensuse 2 Node.js, Leap 2020-10-16 5.0 MEDIUM 7.5 HIGH
Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.
CVE-2019-5737 2 Nodejs, Opensuse 2 Node.js, Leap 2020-10-16 5.0 MEDIUM 7.5 HIGH
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1.
CVE-2018-7166 1 Nodejs 1 Node.js 2020-09-22 5.0 MEDIUM 7.5 HIGH
In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal "fill" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.
CVE-2018-5407 7 Canonical, Debian, Nodejs and 4 more 20 Ubuntu Linux, Debian Linux, Node.js and 17 more 2020-09-18 1.9 LOW 4.7 MEDIUM
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVE-2018-0735 6 Canonical, Debian, Netapp and 3 more 23 Ubuntu Linux, Debian Linux, Cloud Backup and 20 more 2020-08-24 4.3 MEDIUM 5.9 MEDIUM
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).
CVE-2018-0734 6 Canonical, Debian, Netapp and 3 more 20 Ubuntu Linux, Debian Linux, Cloud Backup and 17 more 2020-08-24 4.3 MEDIUM 5.9 MEDIUM
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).
CVE-2015-8854 1 Nodejs 1 Node.js 2020-05-31 7.8 HIGH 7.5 HIGH
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."
CVE-2018-7167 1 Nodejs 1 Node.js 2020-03-20 5.0 MEDIUM 7.5 HIGH
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
CVE-2018-12121 2 Joyent, Nodejs 2 Node.js, Node.js 2020-03-20 5.0 MEDIUM 7.5 HIGH
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.
CVE-2018-12122 3 Joyent, Nodejs, Suse 5 Node.js, Node.js, Suse Enterprise Storage and 2 more 2020-03-20 5.0 MEDIUM 7.5 HIGH
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.
CVE-2018-12123 1 Nodejs 1 Node.js 2020-03-20 4.3 MEDIUM 4.3 MEDIUM
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
CVE-2018-12115 2 Nodejs, Redhat 2 Node.js, Openshift Container Platform 2020-03-20 5.0 MEDIUM 7.5 HIGH
In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.
CVE-2018-12116 3 Joyent, Nodejs, Suse 5 Node.js, Node.js, Suse Enterprise Storage and 2 more 2020-03-20 5.0 MEDIUM 7.5 HIGH
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
CVE-2018-7161 1 Nodejs 1 Node.js 2020-03-20 7.8 HIGH 7.5 HIGH
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.