Node.js — программная платформа, основанная на движке V8 (компилирующем JavaScript в машинный код)

Уязвимость программной платформы Node.js, связанная с недостатками обработки HTTP-запросов, позволяющая нарушителю выполнять атаку "контрабанда HTTP-запросов"

ELSA-2022-5326: compat-openssl10 security update (LOW)

ELSA-2022-4899: compat-openssl11 security and bug fix update (IMPORTANT)

Low: compat-openssl10 security update

Important: compat-openssl11 security and bug fix update

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.