p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de nodejs · Page n° 6

Vulnérabilités publiées pour nodejs au cours des 30 derniers jours : 8. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 125

  1. CVE-2018-12123

    Moyenne · CVSS 4.3EPSS 4,03%Correctif disponible

    CVE-2018-12123

    Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 10.15.0~dfsg-6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2018-12122

    Élevée · CVSS 7.5EPSS 41,29%Correctif disponible

    CVE-2018-12122

    Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 10.15.0~dfsg-6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2018-12121

    Élevée · CVSS 7.5EPSS 10,21%Correctif disponible

    CVE-2018-12121

    Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 10.15.0~dfsg-6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. CVE-2018-12120

    Élevée · CVSS 8.1EPSS 4,28%Correctif disponible

    CVE-2018-12120

    Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 8.9.3~dfsg-5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2018-12116

    Élevée · CVSS 7.5EPSS 4,57%Correctif disponible

    CVE-2018-12116

    Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 10.15.0~dfsg-6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2018-12115

    Élevée · CVSS 7.5EPSS 7,88%Correctif disponible

    CVE-2018-12115

    In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 10.15.0~dfsg-6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2018-7167

    Élevée · CVSS 7.5EPSS 6,69%Correctif disponible

    CVE-2018-7167

    Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 10.15.0~dfsg-6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2018-7164

    Élevée · CVSS 7.5EPSS 6,21%Correctif disponible

    CVE-2018-7164

    Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 10.15.0~dfsg-6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  9. CVE-2018-7162

    Élevée · CVSS 7.5EPSS 6,64%Correctif disponible

    CVE-2018-7162

    All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 10.15.0~dfsg-6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  10. CVE-2018-7161

    Élevée · CVSS 7.5EPSS 7,49%Correctif disponible

    CVE-2018-7161

    All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 10.15.0~dfsg-6
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2018-7160

    Élevée · CVSS 8.8EPSS 9,87%Correctif disponible

    CVE-2018-7160

    The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 8.11.1~dfsg-2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2018-7159

    Moyenne · CVSS 5.3EPSS 3,56%Correctif disponible

    CVE-2018-7159

    The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in use

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 8.11.1~dfsg-2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2018-7158

    Élevée · CVSS 7.5EPSS 3,41%Correctif disponible

    CVE-2018-7158

    The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 6.0.0~dfsg-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  15. CVE-2017-11499

    Élevée · CVSS 7.5EPSS 5,43%Correctif disponible

    CVE-2017-11499

    Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 4.8.4~dfsg-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2016-7099

    Moyenne · CVSS 5.9EPSS 2,84%Correctif disponible

    CVE-2016-7099

    The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 4.6.0~dfsg-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2016-5325

    Moyenne · CVSS 6.1EPSS 4,09%Correctif disponible

    CVE-2016-5325

    CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 4.6.0~dfsg-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2016-1669

    Élevée · CVSS 8.8EPSS 4,23%Correctif disponible

    CVE-2016-1669

    The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 4.4.6~dfsg-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2016-2216

    Élevée · CVSS 7.5EPSS 7,26%Correctif disponible

    CVE-2016-2216

    The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.

    nodejsSystèmes d’exploitation
    • Mettez à jour vers 4.3.0~dfsg-1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →