Debian Nodejs vulnerabilities

CVE-2022-32212 [HIGH] CVE-2022-32212: nodejs - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20... A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks. Scope: local bookworm: resolved (fixed in 18.6.0+dfsg-3) bullseye: resolved (fi

CVE-2020-8265 [HIGH] CVE-2020-8265: nodejs - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a us... Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as par

CVE-2022-32213 [MEDIUM] CVE-2022-32213: llhttp - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.j... The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). Scope: local forky: resolved sid: resolved

CVE-2025-55131 [HIGH] CVE-2025-55131: nodejs - A flaw in Node.js's buffer allocation logic can expose uninitialized memory when... A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like

CVE-2021-22940 [HIGH] CVE-2021-22940: nodejs - Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free at... Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Scope: local bookworm: resolved (fixed in 12.22.5~dfsg-1) bullseye: resolved forky: resolved (fixed in 12.22.5~dfsg-1) sid: resolved (fixed in 12.22.5~dfsg-1) trixie: resolved (fixed in 12.2

CVE-2018-12120 [HIGH] CVE-2018-12120: nodejs - Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any... Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has alwa

CVE-2023-32006 [HIGH] CVE-2023-32006: nodejs - The use of `module.constructor.createRequire()` can bypass the policy mechanism ... The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental fe

CVE-2019-5737 [HIGH] CVE-2019-5737: nodejs - In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, ... In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1, an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly. This keeps the connection and associated resources alive for a long period of time. Potential attacks are mitigated by

CVE-2023-32002 [CRITICAL] CVE-2023-32002: nodejs - The use of `Module._load()` can bypass the policy mechanism and require modules ... The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

CVE-2016-2216 [HIGH] CVE-2016-2216: nodejs - The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.... The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a. Scope: local bookworm: resolved (fixed in 4.3.0~df

CVE-2020-8201 [HIGH] CVE-2020-8201: nodejs - Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks an... Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in proc

CVE-2020-8174 [HIGH] CVE-2020-8174: nodejs - napi_get_value_string_*() allows various kinds of memory corruption in node < 10... napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0. Scope: local bookworm: resolved (fixed in 10.21.0~dfsg-1) bullseye: resolved (fixed in 10.21.0~dfsg-1) forky: resolved (fixed in 10.21.0~dfsg-1) sid: resolved (fixed in 10.21.0~dfsg-1) trixie: resolved (fixed in 10.21.0~dfsg-1)

CVE-2022-35255 [CRITICAL] CVE-2022-35255: nodejs - A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to ... A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntr

CVE-2025-59465 [HIGH] CVE-2025-59465: nodejs - A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can caus... A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:

CVE-2023-32559 [HIGH] CVE-2023-32559: nodejs - A privilege escalation vulnerability exists in the experimental policy mechanism... A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `poli

CVE-2023-23918 [HIGH] CVE-2023-23918: nodejs - A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19... A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option wi

CVE-2018-12121 [HIGH] CVE-2018-12121: nodejs - Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denia... Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigat

CVE-2018-12115 [HIGH] CVE-2018-12115: nodejs - In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS... In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum l

CVE-2020-8287 [MEDIUM] CVE-2020-8287: http-parser - Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a ... Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. Scope: local bookworm: resolved (fixed in 2.9.4-5) bullseye: resolved (fixed in

CVE-2023-30589 [HIGH] CVE-2023-30589: llhttp - The llhttp parser in the http module in Node v20.2.0 does not strictly use the C... The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all N