Debian Nodejs vulnerabilities

CVE-2018-7159 [MEDIUM] CVE-2018-7159: nodejs - The HTTP parser in all current versions of Node.js ignores spaces in the `Conten... The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security ris

CVE-2023-39333 [MEDIUM] CVE-2023-39333: nodejs - Maliciously crafted export names in an imported WebAssembly module can inject Ja... Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable f

CVE-2026-21714 [MEDIUM] CVE-2026-21714: nodejs - A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE... A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25. Scope: local b

CVE-2025-55132 [MEDIUM] CVE-2025-55132: nodejs - A flaw in Node.js's permission model allows a file's access and modification tim... A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps

CVE-2012-2330 [MEDIUM] CVE-2012-2330: nodejs - The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 be... The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string. Scope: local bookworm: resolved (fixed in 0.6.17~dfsg1-1) bullseye: resolved (fixed

CVE-2023-30588 [MEDIUM] CVE-2023-30588: nodejs - When an invalid public key is used to create an x509 certificate using the crypt... When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of th

CVE-2025-23085 [MEDIUM] CVE-2025-23085: nodejs - A memory leak could occur when a remote peer abruptly closes the socket without ... A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. Thi

CVE-2014-5256 [MEDIUM] CVE-2014-5256: nodejs - Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibil... Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program

CVE-2018-12123 [MEDIUM] CVE-2018-12123: nodejs - Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostn... Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are m

CVE-2023-23920 [MEDIUM] CVE-2023-23920: nodejs - An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16... An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges. Scope: local bookworm: resolved (fixed in 18.19.0+dfsg-6~deb12u1) bullseye: resolved (fixed in 12.22.12~dfsg-1~deb11u4) forky: resolved (fixed in 18.13.0+dfsg1

CVE-2026-21716 [LOW] CVE-2026-21716: nodejs - An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle... An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` met

CVE-2026-21715 [LOW] CVE-2026-21715: nodejs - A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSyn... A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targ

CVE-2025-23165 [LOW] CVE-2025-23165: nodejs - In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted ... In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Impact: * This vulnerabilit

CVE-2024-36137 [LOW] CVE-2024-36137: nodejs - A vulnerability has been identified in Node.js, affecting users of the experimen... A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file. Scope: local bookworm: resolved

CVE-2024-22018 [LOW] CVE-2024-22018: nodejs - A vulnerability has been identified in Node.js, affecting users of the experimen... A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulne