Debian Nodejs vulnerabilities

CVE-2024-22019 [HIGH] CVE-2024-22019: nodejs - A vulnerability in Node.js HTTP servers allows an attacker to send a specially c... A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaust

CVE-2018-7161 [HIGH] CVE-2018-7161: nodejs - All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HI... All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. Th

CVE-2023-30590 [HIGH] CVE-2023-30590: nodejs - The generateKeys() API function returned from crypto.createDiffieHellman() only ... The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diff

CVE-2016-2086 [HIGH] CVE-2016-2086: nodejs - Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x ... Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header. Scope: local bookworm: resolved (fixed in 4.3.0~dfsg-1) bullseye: resolved (fixed in 4.3.0~dfsg-1) forky: resolved (fixed in 4.3.0~dfsg-1) sid: resolved (fixed in 4.3.0~df

CVE-2018-12116 [HIGH] CVE-2018-12116: nodejs - Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting... Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server. Scope: local bookworm: resolved (fixed in 10.1

CVE-2018-7167 [HIGH] CVE-2018-7167: nodejs - Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang ... Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulner

CVE-2026-21637 [HIGH] CVE-2026-21637: nodejs - A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust... A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventuall

CVE-2023-46809 [HIGH] CVE-2023-46809: nodejs - Node.js versions which bundle an unpatched version of OpenSSL or run against a d... Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key. Scope: local bookworm: resolved (fixed in 18.20.4+dfsg-1~deb12u

CVE-2018-7164 [HIGH] CVE-2018-7164: nodejs - Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MED... Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restor

CVE-2015-8027 [HIGH] CVE-2015-8027: nodejs - Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not en... Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request. Scope: local bookworm: resolved (fixed in 4.2.3~dfsg-1) bullseye: resolved (fixed in 4.2.3~dfsg-1) forky: r

CVE-2024-21892 [HIGH] CVE-2024-21892: nodejs - On Linux, Node.js ignores certain environment variables if those may have been s... On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allow

CVE-2023-30581 [HIGH] CVE-2023-30581: nodejs - The use of __proto__ in process.mainModule.__proto__.require() can bypass the po... The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of

CVE-2018-7162 [HIGH] CVE-2018-7162: nodejs - All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An... All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementat

CVE-2025-59466 [HIGH] CVE-2025-59466: nodejs - We have identified a bug in Node.js error handling where "Maximum call stack siz... We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22

CVE-2017-11499 [HIGH] CVE-2017-11499: nodejs - Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 th... Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be ove

CVE-2015-6764 [CRITICAL] CVE-2015-6764: nodejs - The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the... The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code. Scope: local boo

CVE-2020-11080 [LOW] CVE-2020-11080: nghttp2 - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload... In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. Ther

CVE-2016-1669 [HIGH] CVE-2016-1669: nodejs - The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Goog... The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted JavaScript code. Scope: local bookworm: resolved (fixed i

CVE-2019-5739 [HIGH] CVE-2019-5739: nodejs - Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 m... Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second

CVE-2018-7158 [HIGH] CVE-2018-7158: nodejs - The `'path'` module in the Node.js 4.x release line contains a potential regular... The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `