Node.js — программная платформа, основанная на движке V8 (компилирующем JavaScript в машинный код)
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|---|---|---|
| 24.22.2 | 24.22.2 | ||
| 24.22.1 | 24.22.1 | ||
| 24.22.0 | 24.22.0 | ||
| 24.21.0 | 24.21.0 | ||
| 24.20.0 | 24.20.0 | ||
| 24.19.0 | 24.19.0 | ||
| 24.18.1 | 24.18.1 | ||
| 24.18.0 | 24.18.0 | ||
| 24.17.0 | 24.17.0 | ||
| 24.16.0 | 24.16.0 |
Показывать по
Количество 1 296
BDU:2023-04973
Уязвимость функции X509_VERIFY_PARAM_add0_policy() библиотеки OpenSSL, позволяющая нарушителю выполнить атаку типа «человек посередине»
BDU:2023-05169
Уязвимость пакета Request программной платформы Node.js, позволяющая нарушителю осуществить SSRF-атаку
SUSE-SU-2023:0682-1
Security update for nodejs12
SUSE-SU-2023:0606-1
Security update for nodejs10
CVE-2023-23918
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
CVE-2023-23920
An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.
CVE-2023-23919
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.
CVE-2023-23918
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14 ...
CVE-2023-23919
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16 ...
CVE-2023-23920
An untrusted search path vulnerability exists in Node.js. <19.6.1, <18 ...
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | BDU:2023-04973 Уязвимость функции X509_VERIFY_PARAM_add0_policy() библиотеки OpenSSL, позволяющая нарушителю выполнить атаку типа «человек посередине» | CVSS3: 5.3 | 2% Низкий | больше 3 лет назад |
| BDU:2023-05169 Уязвимость пакета Request программной платформы Node.js, позволяющая нарушителю осуществить SSRF-атаку | CVSS3: 6.1 | 1% Низкий | больше 3 лет назад |
 | SUSE-SU-2023:0682-1 Security update for nodejs12 | 0% Низкий | больше 3 лет назад | |
| SUSE-SU-2023:0606-1 Security update for nodejs10 | 0% Низкий | больше 3 лет назад | |
 | CVE-2023-23918 A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy. | CVSS3: 7.5 | 2% Низкий | больше 3 лет назад |
| CVE-2023-23920 An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges. | CVSS3: 4.2 | 0% Низкий | больше 3 лет назад |
| CVE-2023-23919 A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service. | CVSS3: 7.5 | 2% Низкий | больше 3 лет назад |
| CVE-2023-23918 A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14 ... | CVSS3: 7.5 | 2% Низкий | больше 3 лет назад |
| CVE-2023-23919 A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16 ... | CVSS3: 7.5 | 2% Низкий | больше 3 лет назад |
| CVE-2023-23920 An untrusted search path vulnerability exists in Node.js. <19.6.1, <18 ... | CVSS3: 4.2 | 0% Низкий | больше 3 лет назад |
Уязвимостей на страницу