CVSS: 8.5EPSS: 0%CPEs: 18EXPL: 0CVE-2024-27982 – nodejs: HTTP Request Smuggling via Content Length Obfuscation
https://notcve.org/view.php?id=CVE-2024-27982
16 Apr 2024 — The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first. El equipo ha identificado una vulnerabilidad crítica en el servidor http de la versión más reciente de Node, donde los encabezados con formato incorrecto pueden provoca... • https://hackerone.com/reports/2237099 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 10.0EPSS: 64%CPEs: 18EXPL: 1CVE-2024-27983 – nodejs: CONTINUATION frames DoS
https://notcve.org/view.php?id=CVE-2024-27983
09 Apr 2024 — An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition. Un atacante puede hacer que el ser... • https://github.com/lirantal/CVE-2024-27983-nodejs-http2 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-30260 – Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
https://notcve.org/view.php?id=CVE-2024-30260
04 Apr 2024 — Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1. Undici es un cliente HTTP/1.1, escrito desde cero para Node.js. Undici borró los encabezados Authorization y Proxy-Authorization para `fetch()`, pero no los borró para `undici.request()`. • https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f • CWE-285: Improper Authorization •
CVSS: 2.6EPSS: 0%CPEs: 2EXPL: 0CVE-2024-30261 – Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
https://notcve.org/view.php?id=CVE-2024-30261
04 Apr 2024 — Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1. Undici es un cliente HTTP/1.1, escrito desde cero para Node.js. Un atacante puede alterar la opción `integridad` pasada a `fetch()`, permitiendo que `fetch()` acepte solicitudes como válidas incluso si han sido manipuladas. • https://github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055 • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 17EXPL: 1CVE-2024-22017 – nodejs: setuid() does not drop all privileges due to io_uring
https://notcve.org/view.php?id=CVE-2024-22017
19 Mar 2024 — setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21. setuid() no afecta las operaciones io_uring internas de libuv si se inicializa antes de la llamada a setuid(). Esto permite que el proceso realice ope... • https://github.com/SpiralBL0CK/cve-2024-22017_to_test • CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 0CVE-2024-22025 – nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service
https://notcve.org/view.php?id=CVE-2024-22025
01 Mar 2024 — A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potent... • https://hackerone.com/reports/2284065 • CWE-400: Uncontrolled Resource Consumption CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.4EPSS: 0%CPEs: 18EXPL: 0CVE-2023-46809 – nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)
https://notcve.org/view.php?id=CVE-2023-46809
01 Mar 2024 — Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key. A flaw was found in Node.js. The privateDecrypt() API of the crypto library may allow a covert timing side-channel during PKCS#1 v1.5 padding error handling. This issue revealed significant timing differenc... • https://nodejs.org/en/blog/vulnerability/february-2024-security-releases • CWE-208: Observable Timing Discrepancy CWE-385: Covert Timing Channel •
CVSS: 7.9EPSS: 0%CPEs: 17EXPL: 0CVE-2024-21896 – nodejs: path traversal by monkey-patching buffer internals
https://notcve.org/view.php?id=CVE-2024-21896
20 Feb 2024 — The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission mode... • http://www.openwall.com/lists/oss-security/2024/03/11/1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-27: Path Traversal: 'dir/../../filename' •
CVSS: 6.8EPSS: 0%CPEs: 17EXPL: 0CVE-2024-21890 – nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write
https://notcve.org/view.php?id=CVE-2024-21890
20 Feb 2024 — The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. El modelo de permisos ... • http://www.openwall.com/lists/oss-security/2024/03/11/1 • CWE-1059: Insufficient Technical Documentation •
CVSS: 7.9EPSS: 0%CPEs: 17EXPL: 0CVE-2024-21891 – nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization
https://notcve.org/view.php?id=CVE-2024-21891
20 Feb 2024 — Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Node.js depende de múltiples funciones de utilidad inte... • http://www.openwall.com/lists/oss-security/2024/03/11/1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •