Debian Nodejs vulnerabilities

CVE-2024-27983 [HIGH] CVE-2024-27983: nodejs - An attacker can make the Node.js HTTP/2 server completely unavailable by sending... An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Sessi

CVE-2019-15605 [CRITICAL] CVE-2019-15605: http-parser - HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delive... HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed Scope: local bookworm: resolved (fixed in 2.9.4-2) bullseye: resolved (fixed in 2.9.4-2) forky: resolved (fixed in 2.9.4-2) sid: resolved (fixed in 2.9.4-2) trixie: resolved (fixed in 2.9.4-2)

CVE-2019-9513 [HIGH] CVE-2019-9513: nghttp2 - Some HTTP/2 implementations are vulnerable to resource loops, potentially leadin... Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU. Scope: local bookworm: resolved (fixed in 1.39.2-1) bullseye: resolved (fix

CVE-2019-9514 [HIGH] CVE-2019-9514: h2o - Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading... Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. Scope: local book

CVE-2021-22883 [HIGH] CVE-2021-22883: nodejs - Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial ... Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e

CVE-2021-22930 [CRITICAL] CVE-2021-22930: nodejs - Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free at... Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Scope: local bookworm: resolved (fixed in 12.22.4~dfsg-1) bullseye: resolved (fixed in 12.22.5~dfsg-2~11u1) forky: resolved (fixed in 12.22.4~dfsg-1) sid: resolved (fixed in 12.22.4~dfsg

CVE-2019-9511 [HIGH] CVE-2019-9511: nghttp2 - Some HTTP/2 implementations are vulnerable to window size manipulation and strea... Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how

CVE-2019-15606 [CRITICAL] CVE-2019-15606: nodejs - Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 ca... Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons Scope: local bookworm: resolved (fixed in 10.19.0~dfsg-1) bullseye: resolved (fixed in 10.19.0~dfsg-1) forky: resolved (fixed in 10.19.0~dfsg-1) sid: resolved (fixed in 10.19.0~dfsg-1) trixie: resolved (fixed in 10.19.0~df

CVE-2022-32214 [MEDIUM] CVE-2022-32214: llhttp - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.j... The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). Scope: local forky: resolved sid: resolved

CVE-2013-4450 [MEDIUM] CVE-2013-4450: nodejs - The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows ... The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response. Scope: local bookworm: resolved (fixed in 0.10.21~dfsg1-1) bullseye: resolved (fixed in 0.10.21~dfsg1-1) forky: resolved (fixed in 0.10.

CVE-2021-22884 [HIGH] CVE-2021-22884: nodejs - Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebin... Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be

CVE-2025-55130 [CRITICAL] CVE-2025-55130: nodejs - A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-rea... A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbi

CVE-2026-21710 [HIGH] CVE-2026-21710: nodejs - A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a re... A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside

CVE-2022-32215 [MEDIUM] CVE-2022-32215: llhttp - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.j... The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). Scope: local forky: resolved sid: resolved

CVE-2022-21824 [HIGH] CVE-2022-21824: nodejs - Due to the formatting logic of the "console.table()" function it was not safe to... Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be

CVE-2022-43548 [HIGH] CVE-2022-43548: nodejs - A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18... A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?na

CVE-2018-7160 [HIGH] CVE-2018-7160: nodejs - The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack ... The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to t

CVE-2018-12122 [HIGH] CVE-2018-12122: nodejs - Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowl... Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time. Scope: local bookworm: resolved (fixed in 10.15.0~dfsg-6) bullseye: resolved (fixed in 10

CVE-2019-15604 [HIGH] CVE-2019-15604: nodejs - Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to ... Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate Scope: local bookworm: resolved (fixed in 10.19.0~dfsg-1) bullseye: resolved (fixed in 10.19.0~dfsg-1) forky: resolved (fixed in 10.19.0~dfsg-1) sid: resolved (fixed in 10.19.0~dfsg-1) trixie: resolved (fixed in 10.19.0~dfsg-1)

CVE-2021-44531 [HIGH] CVE-2021-44531: nodejs - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specif... Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not m