CVE-2023-23918
High · 7.5CVSS
7.5
EPSS
2.0%
Published
Feb 23, 2023
CISA due date
—
Cloudanix analysis
Monitor only
SSVC: Track
A bug in Node.js could let attackers slip unauthorized web requests past normal security checks on servers that run the software.
- Exploitation
- Other
- Attacker needs
- None
- Complexity
- Low
- Impact
- Other
- Component
- Other
- Class
- Other
- Remediation
- Other
- Effort
- Other
- Patch risk
- Other
What it actually does
The flaw permits HTTP request smuggling through inconsistent parsing of HTTP requests in the Node.js HTTP stack.
Why it matters to the business
Attackers may bypass access controls, poison caches, or reach internal resources in web services built on affected Node.js versions, increasing breach risk for any organization using the runtime in production.
How an attack unfolds
An attacker sends specially crafted HTTP requests that are interpreted differently by front-end proxies and the Node.js backend, allowing hidden requests to be smuggled past security boundaries.
How to fix it
Upgrade Node.js to a build containing commit 7bc2cf7fa9a2016fadb27e042968a69297bd975e or later; rebuild any custom binaries from the patched source.
How to confirm the fix worked
Confirm the running Node.js binary was built from source at or after commit 7bc2cf7fa9a2016fadb27e042968a69297bd975e and test with known smuggling request patterns.
Typical attack path
- Scan for publicly reachable Node.js HTTP servers
- Craft and send smuggling requests that exploit parser differences
- Use smuggled requests to access protected endpoints or inject malicious content
How to detect it
Inspect web server and proxy logs for anomalous request sequences, duplicate Content-Length headers, or unexpected backend responses that do not match front-end logs.
What your security team should do
- Prioritize patching all internet-facing Node.js instances within standard change windows
- Review proxy and load-balancer configurations for request normalization rules
- Add HTTP request smuggling test cases to regression suites
The record
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 0 | 1:14.21.3-1.module_el8.7.0+3551+53700ee8 |
| AlmaLinux:8 | nodejs | 0 | 1:16.19.1-1.module_el8.7.0+3496+a59a3324 |
| AlmaLinux:8 | nodejs | 0 | 1:18.14.2-2.module_el8.7.0+3497+c65299e7 |
| AlmaLinux:8 | nodejs-devel | 0 | 1:14.21.3-1.module_el8.7.0+3551+53700ee8 |
| AlmaLinux:8 | nodejs-devel | 0 | 1:16.19.1-1.module_el8.7.0+3496+a59a3324 |
| AlmaLinux:8 | nodejs-devel | 0 | 1:18.14.2-2.module_el8.7.0+3497+c65299e7 |
| AlmaLinux:8 | nodejs-docs | 0 | 1:14.21.3-1.module_el8.7.0+3551+53700ee8 |
| AlmaLinux:8 | nodejs-docs | 0 | 1:16.19.1-1.module_el8.7.0+3496+a59a3324 |
| AlmaLinux:8 | nodejs-docs | 0 | 1:18.14.2-2.module_el8.7.0+3497+c65299e7 |
| AlmaLinux:8 | nodejs-full-i18n | 0 | 1:14.21.3-1.module_el8.7.0+3551+53700ee8 |
| AlmaLinux:8 | nodejs-full-i18n | 0 | 1:16.19.1-1.module_el8.7.0+3496+a59a3324 |
| AlmaLinux:8 | nodejs-full-i18n | 0 | 1:18.14.2-2.module_el8.7.0+3497+c65299e7 |
| AlmaLinux:8 | nodejs-nodemon | 0 | 2.0.20-3.module_el8.7.0+3551+53700ee8 |
| AlmaLinux:8 | nodejs-nodemon | 0 | 2.0.20-3.module_el8.7.0+3496+a59a3324 |
| AlmaLinux:8 | nodejs-nodemon | 0 | 2.0.20-2.module_el8.7.0+3497+c65299e7 |
| AlmaLinux:8 | nodejs-packaging | 0 | 23-3.module_el8.4.0+2522+3bd42762 |
| AlmaLinux:8 | nodejs-packaging | 0 | 25-1.module_el8.5.0+2605+45d748af |
| AlmaLinux:8 | nodejs-packaging | 0 | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux:8 | nodejs-packaging-bundler | 0 | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux:8 | npm | 0 | 1:6.14.18-1.14.21.3.1.module_el8.7.0+3551+53700ee8 |
| AlmaLinux:8 | npm | 0 | 1:8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324 |
| AlmaLinux:8 | npm | 0 | 1:9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7 |
| AlmaLinux:9 | nodejs | 0 | 1:18.14.2-2.module_el9.2.0+29+de583a0b |
| AlmaLinux:9 | nodejs | 0 | 1:16.19.1-1.el9_2 |
| AlmaLinux:9 | nodejs-devel | 0 | 1:18.14.2-2.module_el9.2.0+29+de583a0b |
| AlmaLinux:9 | nodejs-docs | 0 | 1:18.14.2-2.module_el9.2.0+29+de583a0b |
| AlmaLinux:9 | nodejs-docs | 0 | 1:16.19.1-1.el9_2 |
| AlmaLinux:9 | nodejs-full-i18n | 0 | 1:18.14.2-2.module_el9.2.0+29+de583a0b |
| AlmaLinux:9 | nodejs-full-i18n | 0 | 1:16.19.1-1.el9_2 |
| AlmaLinux:9 | nodejs-libs | 0 | 1:16.19.1-1.el9_2 |
| AlmaLinux:9 | nodejs-nodemon | 0 | 2.0.20-2.module_el9.2.0+29+de583a0b |
| AlmaLinux:9 | nodejs-packaging | 0 | 2021.06-4.module_el9.1.0+13+d9a595ea |
| AlmaLinux:9 | nodejs-packaging-bundler | 0 | 2021.06-4.module_el9.1.0+13+d9a595ea |
| AlmaLinux:9 | npm | 0 | 1:9.5.0-1.18.14.2.2.module_el9.2.0+29+de583a0b |
| AlmaLinux:9 | npm | 0 | 1:8.19.3-1.16.19.1.1.el9_2 |
| Alpine:v3.14 | nodejs | 0 | 14.21.3-r0 |
| Alpine:v3.15 | nodejs | 0 | 16.19.1-r0 |
| Alpine:v3.16 | nodejs | 0 | 16.19.1-r0 |
| Alpine:v3.17 | nodejs | 0 | 18.14.1-r0 |
| Alpine:v3.18 | nodejs | 0 | 18.14.1-r0 |
| Alpine:v3.19 | nodejs | 0 | 18.14.1-r0 |
| Alpine:v3.20 | nodejs | 0 | 18.14.1-r0 |
| Alpine:v3.21 | nodejs | 0 | 18.14.1-r0 |
| Alpine:v3.22 | nodejs | 0 | 18.14.1-r0 |
| Bitnami | node | 14.0.0 | 14.14.0 |
| Bitnami | node | 14.0.0 | 14.21.3 |
| Bitnami | node-min | 14.0.0 | 14.14.0 |
| Bitnami | node-min | 14.0.0 | 14.21.3 |
| Debian:12 | nodejs | 0 | 18.19.0+dfsg-6~deb12u1 |
| Debian:13 | nodejs | 0 | 18.19.0+dfsg-2 |
| Mageia:8 | nodejs | 0 | 14.21.3-2.1.mga8 |
| Red Hat:enterprise_linux:8::appstream | nodejs | 0 | 1:16.19.1-1.module+el8.7.0+18373+704f5cef |
| Red Hat:enterprise_linux:8::appstream | nodejs | 0 | 1:18.14.2-2.module+el8.7.0+18445+9493b6ea |
| Red Hat:enterprise_linux:8::appstream | nodejs | 0 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 |
| Red Hat:enterprise_linux:8::appstream | nodejs-debuginfo | 0 | 1:16.19.1-1.module+el8.7.0+18373+704f5cef |
| Red Hat:enterprise_linux:8::appstream | nodejs-debuginfo | 0 | 1:18.14.2-2.module+el8.7.0+18445+9493b6ea |
| Red Hat:enterprise_linux:8::appstream | nodejs-debuginfo | 0 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 |
| Red Hat:enterprise_linux:8::appstream | nodejs-debugsource | 0 | 1:16.19.1-1.module+el8.7.0+18373+704f5cef |
| Red Hat:enterprise_linux:8::appstream | nodejs-debugsource | 0 | 1:18.14.2-2.module+el8.7.0+18445+9493b6ea |
| Red Hat:enterprise_linux:8::appstream | nodejs-debugsource | 0 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 |
| Red Hat:enterprise_linux:8::appstream | nodejs-devel | 0 | 1:16.19.1-1.module+el8.7.0+18373+704f5cef |
| Red Hat:enterprise_linux:8::appstream | nodejs-devel | 0 | 1:18.14.2-2.module+el8.7.0+18445+9493b6ea |
| Red Hat:enterprise_linux:8::appstream | nodejs-devel | 0 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 |
| Red Hat:enterprise_linux:8::appstream | nodejs-docs | 0 | 1:16.19.1-1.module+el8.7.0+18373+704f5cef |
| Red Hat:enterprise_linux:8::appstream | nodejs-docs | 0 | 1:18.14.2-2.module+el8.7.0+18445+9493b6ea |
| Red Hat:enterprise_linux:8::appstream | nodejs-docs | 0 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 |
| Red Hat:enterprise_linux:8::appstream | nodejs-full-i18n | 0 | 1:16.19.1-1.module+el8.7.0+18373+704f5cef |
| Red Hat:enterprise_linux:8::appstream | nodejs-full-i18n | 0 | 1:18.14.2-2.module+el8.7.0+18445+9493b6ea |
| Red Hat:enterprise_linux:8::appstream | nodejs-full-i18n | 0 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 |
| Red Hat:enterprise_linux:8::appstream | nodejs-nodemon | 0 | 0:2.0.20-3.module+el8.7.0+18373+704f5cef |
| Red Hat:enterprise_linux:8::appstream | nodejs-nodemon | 0 | 0:2.0.20-2.module+el8.7.0+18445+9493b6ea |
| Red Hat:enterprise_linux:8::appstream | nodejs-nodemon | 0 | 0:2.0.20-3.module+el8.7.0+18531+81d21ca6 |
| Red Hat:enterprise_linux:8::appstream | nodejs-packaging | 0 | 0:25-1.module+el8.5.0+10992+fac5fe06 |
| Red Hat:enterprise_linux:8::appstream | nodejs-packaging | 0 | 0:2021.06-4.module+el8.7.0+15582+19c314fa |
| Red Hat:enterprise_linux:8::appstream | nodejs-packaging | 0 | 0:23-3.module+el8.3.0+6519+9f98ed83 |
| Red Hat:enterprise_linux:8::appstream | nodejs-packaging-bundler | 0 | 0:2021.06-4.module+el8.7.0+15582+19c314fa |
| Red Hat:enterprise_linux:8::appstream | npm | 0 | 1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef |
| Red Hat:enterprise_linux:8::appstream | npm | 0 | 1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea |
| Red Hat:enterprise_linux:8::appstream | npm | 0 | 1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6 |
| Red Hat:enterprise_linux:9::appstream | nodejs | 0 | 1:18.14.2-2.module+el9.2.0.z+18497+a402347c |
| Red Hat:enterprise_linux:9::appstream | nodejs | 0 | 1:16.19.1-1.el9_2 |
| Red Hat:enterprise_linux:9::appstream | nodejs-debuginfo | 0 | 1:18.14.2-2.module+el9.2.0.z+18497+a402347c |
| Red Hat:enterprise_linux:9::appstream | nodejs-debuginfo | 0 | 1:16.19.1-1.el9_2 |
| Red Hat:enterprise_linux:9::appstream | nodejs-debugsource | 0 | 1:18.14.2-2.module+el9.2.0.z+18497+a402347c |
| Red Hat:enterprise_linux:9::appstream | nodejs-debugsource | 0 | 1:16.19.1-1.el9_2 |
| Red Hat:enterprise_linux:9::appstream | nodejs-devel | 0 | 1:18.14.2-2.module+el9.2.0.z+18497+a402347c |
| Red Hat:enterprise_linux:9::appstream | nodejs-docs | 0 | 1:18.14.2-2.module+el9.2.0.z+18497+a402347c |
| Red Hat:enterprise_linux:9::appstream | nodejs-docs | 0 | 1:16.19.1-1.el9_2 |
| Red Hat:enterprise_linux:9::appstream | nodejs-full-i18n | 0 | 1:18.14.2-2.module+el9.2.0.z+18497+a402347c |
| Red Hat:enterprise_linux:9::appstream | nodejs-full-i18n | 0 | 1:16.19.1-1.el9_2 |
| Red Hat:enterprise_linux:9::appstream | nodejs-libs | 0 | 1:16.19.1-1.el9_2 |
| Red Hat:enterprise_linux:9::appstream | nodejs-libs-debuginfo | 0 | 1:16.19.1-1.el9_2 |
| Red Hat:enterprise_linux:9::appstream | nodejs-nodemon | 0 | 0:2.0.20-2.module+el9.2.0.z+18497+a402347c |
| Red Hat:enterprise_linux:9::appstream | nodejs-nodemon | 0 | 0:2.0.20-3.el9_2 |
| Red Hat:enterprise_linux:9::appstream | nodejs-packaging | 0 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 |
| Red Hat:enterprise_linux:9::appstream | nodejs-packaging-bundler | 0 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 |
| Red Hat:enterprise_linux:9::appstream | npm | 0 | 1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c |
| Red Hat:enterprise_linux:9::appstream | npm | 0 | 1:8.19.3-1.16.19.1.1.el9_2 |
| Red Hat:rhel_eus:8.4::appstream | nodejs | 0 | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 |
| Red Hat:rhel_eus:8.4::appstream | nodejs-debuginfo | 0 | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 |
| Red Hat:rhel_eus:8.4::appstream | nodejs-debugsource | 0 | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 |
| Red Hat:rhel_eus:8.4::appstream | nodejs-devel | 0 | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 |
| Red Hat:rhel_eus:8.4::appstream | nodejs-docs | 0 | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 |
| Red Hat:rhel_eus:8.4::appstream | nodejs-full-i18n | 0 | 1:14.21.3-1.module+el8.4.0+18317+43f5ac16 |
| Red Hat:rhel_eus:8.4::appstream | nodejs-nodemon | 0 | 0:2.0.20-3.module+el8.4.0+18317+43f5ac16 |
| Red Hat:rhel_eus:8.4::appstream | nodejs-packaging | 0 | 0:23-3.module+el8.3.0+6519+9f98ed83 |
| Red Hat:rhel_eus:8.4::appstream | npm | 0 | 1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16 |
| Red Hat:rhel_eus:8.6::appstream | nodejs | 0 | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 |
| Red Hat:rhel_eus:8.6::appstream | nodejs-debuginfo | 0 | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 |
| Red Hat:rhel_eus:8.6::appstream | nodejs-debugsource | 0 | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 |
| Red Hat:rhel_eus:8.6::appstream | nodejs-devel | 0 | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 |
| Red Hat:rhel_eus:8.6::appstream | nodejs-docs | 0 | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 |
| Red Hat:rhel_eus:8.6::appstream | nodejs-full-i18n | 0 | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 |
| Red Hat:rhel_eus:8.6::appstream | nodejs-nodemon | 0 | 0:2.0.20-3.module+el8.6.0+18532+cbe6f646 |
| Red Hat:rhel_eus:8.6::appstream | nodejs-packaging | 0 | 0:23-3.module+el8.3.0+6519+9f98ed83 |
| Red Hat:rhel_eus:8.6::appstream | npm | 0 | 1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646 |
| Red Hat:rhel_software_collections:3::el7 | rh-nodejs14 | 0 | 0:3.6-2.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-nodejs14-nodejs | 0 | 0:14.21.3-2.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-nodejs14-nodejs-debuginfo | 0 | 0:14.21.3-2.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-nodejs14-nodejs-devel | 0 | 0:14.21.3-2.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-nodejs14-nodejs-docs | 0 | 0:14.21.3-2.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-nodejs14-nodejs-full-i18n | 0 | 0:14.21.3-2.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-nodejs14-npm | 0 | 0:6.14.18-14.21.3.2.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-nodejs14-runtime | 0 | 0:3.6-2.el7 |
| Red Hat:rhel_software_collections:3::el7 | rh-nodejs14-scldevel | 0 | 0:3.6-2.el7 |
| Rocky Linux:8 | nodejs | 0 | 1:16.19.1-1.module+el8.7.0+1178+d52dba78 |
| Rocky Linux:8 | nodejs | 0 | 1:18.14.2-2.module+el8.7.0+1177+510ae886 |
| Rocky Linux:8 | nodejs | 0 | 1:14.21.3-1.module+el8.7.0+1183+c2c35f0a |
| Rocky Linux:8 | nodejs-nodemon | 0 | 0:2.0.20-3.module+el8.7.0+1178+d52dba78 |
| Rocky Linux:8 | nodejs-nodemon | 0 | 0:2.0.20-2.module+el8.7.0+1108+49363b0d |
| Rocky Linux:8 | nodejs-packaging | 0 | 0:25-1.module+el8.6.0+1046+80feca58 |
| Rocky Linux:8 | nodejs-packaging | 0 | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
| Rocky Linux:8 | nodejs-packaging | 0 | 0:23-3.module+el8.7.0+1071+4bdda2a8 |
| Rocky Linux:9 | nodejs | 0 | 1:16.19.1-1.el9_2 |
| Rocky Linux:9 | nodejs-nodemon | 0 | 0:2.0.20-3.el9_2 |
| SUSE:Enterprise Storage 7 | nodejs12 | 0 | 12.22.12-150200.4.50.1 |
| SUSE:Enterprise Storage 7 | nodejs14 | 0 | 14.21.3-150200.15.43.1 |
| SUSE:Enterprise Storage 7.1 | nodejs12 | 0 | 12.22.12-150200.4.50.1 |
| SUSE:Enterprise Storage 7.1 | nodejs14 | 0 | 14.21.3-150200.15.43.1 |
| SUSE:Enterprise Storage 7.1 | nodejs16 | 0 | 16.19.1-150300.7.18.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | nodejs12 | 0 | 12.22.12-150200.4.50.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | nodejs14 | 0 | 14.21.3-150200.15.43.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | nodejs12 | 0 | 12.22.12-150200.4.50.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | nodejs14 | 0 | 14.21.3-150200.15.43.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | nodejs16 | 0 | 16.19.1-150300.7.18.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | nodejs12 | 0 | 12.22.12-150200.4.50.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | nodejs14 | 0 | 14.21.3-150200.15.43.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | nodejs16 | 0 | 16.19.1-150300.7.18.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 12 | nodejs14 | 0 | 14.21.3-6.40.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 12 | nodejs16 | 0 | 16.19.1-8.24.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 12 | nodejs18 | 0 | 18.14.2-8.6.2 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | nodejs16 | 0 | 16.19.1-150400.3.15.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | nodejs18 | 0 | 18.14.2-150400.9.6.2 |
| SUSE:Linux Enterprise Server 15 SP2-LTSS | nodejs12 | 0 | 12.22.12-150200.4.50.1 |
| SUSE:Linux Enterprise Server 15 SP2-LTSS | nodejs14 | 0 | 14.21.3-150200.15.43.1 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | nodejs12 | 0 | 12.22.12-150200.4.50.1 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | nodejs14 | 0 | 14.21.3-150200.15.43.1 |
| SUSE:Linux Enterprise Server 15 SP3-LTSS | nodejs16 | 0 | 16.19.1-150300.7.18.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | nodejs12 | 0 | 12.22.12-150200.4.50.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | nodejs14 | 0 | 14.21.3-150200.15.43.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | nodejs12 | 0 | 12.22.12-150200.4.50.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | nodejs14 | 0 | 14.21.3-150200.15.43.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | nodejs16 | 0 | 16.19.1-150300.7.18.1 |
| SUSE:Manager Server 4.2 | nodejs12 | 0 | 12.22.12-150200.4.50.1 |
| SUSE:Manager Server 4.2 | nodejs14 | 0 | 14.21.3-150200.15.43.1 |
| SUSE:Manager Server 4.2 | nodejs16 | 0 | 16.19.1-150300.7.18.1 |
| Ubuntu:24.04:LTS | nodejs | 0 | 18.19.1+dfsg-2ubuntu4 |
| openSUSE:Leap 15.4 | nodejs12 | 0 | 12.22.12-150200.4.50.1 |
| openSUSE:Leap 15.4 | nodejs14 | 0 | 14.21.3-150200.15.43.1 |
| openSUSE:Leap 15.4 | nodejs16 | 0 | 16.19.1-150400.3.15.1 |
| openSUSE:Leap 15.4 | nodejs18 | 0 | 18.14.2-150400.9.6.2 |
| openSUSE:Tumbleweed | nodejs18 | 0 | 18.14.2-1.1 |
| openSUSE:Tumbleweed | nodejs19 | 0 | 19.7.0-1.1 |
Related vulnerabilities
- CVE-2025-6965 There exists a vulnerability in SQLite versions before 3.50.2 where the number of… Also affects nodejs
- CVE-2025-3277 An integer overflow can be triggered in SQLite’s `concat_ws()` function. Also affects nodejs
- CVE-2025-31498 c-ares is an asynchronous resolver library. Also affects nodejs
- CVE-2025-23085 A memory leak could occur when a remote peer abruptly closes the socket without sending a… Also affects nodejs
- CVE-2025-23083 With the aid of the diagnostics_channel utility, an event can be hooked into whenever a… Also affects nodejs
- CVE-2025-22150 Undici is an HTTP/1.1 client. Also affects nodejs
- CVE-2023-39333 Maliciously crafted export names in an imported WebAssembly module can inject JavaScript… Also affects nodejs
- CVE-2023-46809 Node.js versions which bundle an unpatched version of OpenSSL or run against a… Also affects nodejs