Debian Nodejs vulnerabilities

CVE-2023-23919 [HIGH] CVE-2023-23919: nodejs - A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14... A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service. Scope: loc

CVE-2023-38552 [HIGH] CVE-2023-38552: nodejs - When the Node.js policy feature checks the integrity of a resource against a tru... When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 1

CVE-2025-23083 [HIGH] CVE-2025-23083: nodejs - With the aid of the diagnostics_channel utility, an event can be hooked into whe... With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Nod

CVE-2025-23166 [HIGH] CVE-2025-23166: nodejs - The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() ba... The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime. Scope: local bookworm: open bu

CVE-2015-7384 [HIGH] CVE-2015-7384: nodejs - Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of ser... Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service. Scope: local bookworm: resolved (fixed in 4.1.1~dfsg-3) bullseye: resolved (fixed in 4.1.1~dfsg-3) forky: resolved (fixed in 4.1.1~dfsg-3) sid: resolved (fixed in 4.1.1~dfsg-3) trixie: resolved (fixed in 4.1.1~dfsg-3)

CVE-2021-44532 [MEDIUM] CVE-2021-44532: nodejs - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alt... Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name con

CVE-2021-22960 [MEDIUM] CVE-2021-22960: nodejs - The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when ... The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. Scope: local bookworm: resolved (fixed in 12.22.7~dfsg-1) bullseye: resolved (fixed in 12.22.12~dfsg-1~deb11u1) forky: resolved (fixed in 12.22.7~dfsg-1) sid: resolved (fixed in 12

CVE-2014-9748 [HIGH] CVE-2014-9748: nodejs - The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv ... The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition. Scope: local bookworm: resolved (fixed in 4.0.0~dfsg-1) bullseye

CVE-2021-22939 [MEDIUM] CVE-2021-22939: nodejs - If the Node.js https API was used incorrectly and "undefined" was in passed for ... If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. Scope: local bookworm: resolved (fixed in 12.22.5~dfsg-1) bullseye: resolved (fixed in 12.22.5~dfsg-2~11u1) forky: resolved (fixed in 12.22.5~dfsg-1

CVE-2024-27982 [MEDIUM] CVE-2024-27982: nodejs - The team has identified a critical vulnerability in the http server of the most ... The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first. Scope: local bookworm:

CVE-2021-44533 [MEDIUM] CVE-2021-44533: nodejs - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value... Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the

CVE-2022-35256 [MEDIUM] CVE-2022-35256: llhttp - The llhttp parser in the http module in Node v18.7.0 does not correctly handle h... The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. Scope: local forky: resolved sid: resolved

CVE-2024-22020 [MEDIUM] CVE-2024-22020: nodejs - A security flaw in Node.js allows a bypass of network import restrictions. By e... A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a ri

CVE-2025-47153 [MEDIUM] CVE-2025-47153: nodejs - Certain build processes for libuv and Node.js for 32-bit systems, such as for th... Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), lea

CVE-2021-22959 [MEDIUM] CVE-2021-22959: nodejs - The parser in accepts requests with a space (SP) right after the header name bef... The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. Scope: local bookworm: resolved (fixed in 12.22.7~dfsg-1) bullseye: resolved (fixed in 12.22.12~dfsg-1~deb11u1) forky: resolved (fixed in 12.22.7~dfsg-1) sid: resolved (fixed in 12.22.7~dfsg-1)

CVE-2026-21713 [MEDIUM] CVE-2026-21713: nodejs - A flaw in Node.js HMAC verification uses a non-constant-time comparison when val... A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js al

CVE-2024-22025 [MEDIUM] CVE-2024-22025: nodejs - A vulnerability in Node.js has been identified, allowing for a Denial of Service... A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fet

CVE-2026-21717 [MEDIUM] CVE-2026-21717: nodejs - A flaw in V8's string hashing mechanism causes integer-like strings to be hashed... A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON

CVE-2016-5325 [MEDIUM] CVE-2016-5325: nodejs - CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js... CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument. Scope: local bookworm: resolved (fixed in 4.6.0~dfsg-1) bullseye: resolved (f

CVE-2016-7099 [MEDIUM] CVE-2016-7099: nodejs - The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x be... The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate. Scope: local bookworm: resolved (fixed in 4.6.0~dfsg-1) bullseye: resolved (fi