Node.js — программная платформа, основанная на движке V8 (компилирующем JavaScript в машинный код)
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|---|---|---|
| 24.22.2 | 24.22.2 | ||
| 24.22.1 | 24.22.1 | ||
| 24.22.0 | 24.22.0 | ||
| 24.21.0 | 24.21.0 | ||
| 24.20.0 | 24.20.0 | ||
| 24.19.0 | 24.19.0 | ||
| 24.18.1 | 24.18.1 | ||
| 24.18.0 | 24.18.0 | ||
| 24.17.0 | 24.17.0 | ||
| 24.16.0 | 24.16.0 |
Показывать по
Количество 1 296
CVE-2020-8252
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
CVE-2020-8251
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
CVE-2020-8252
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
CVE-2020-8251
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.
CVE-2020-8201
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.
GHSA-69rr-wvh9-6c4q
Directory Traversal in st
CVE-2020-8174
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
CVE-2020-8174
napi_get_value_string_*() allows various kinds of memory corruption in ...
BDU:2020-05054
Уязвимость компонента Cluster: JS module (Node.js) системы управления базами данных Oracle MySQL Cluster, позволяющая нарушителю выполнить произвольный код
BDU:2020-04460
Уязвимость функций napi_get_value_string_latin1(), napi_get_value_string_utf8(), napi_get_value_string_utf16() программной платформы Node.js, позволяющая нарушителю выполнить произвольный код
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2020-8252 The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes. | CVSS3: 7.8 | 1% Низкий | около 6 лет назад |
| CVE-2020-8251 Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections. | CVSS3: 7.5 | 8% Низкий | около 6 лет назад |
 | CVE-2020-8252 The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes. | CVSS3: 7.8 | 1% Низкий | около 6 лет назад |
| CVE-2020-8251 Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections. | CVSS3: 7.5 | 8% Низкий | около 6 лет назад |
| CVE-2020-8201 Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names. | CVSS3: 7.4 | 5% Низкий | около 6 лет назад |
| GHSA-69rr-wvh9-6c4q Directory Traversal in st | CVSS3: 7.5 | 34% Средний | около 6 лет назад |
 | CVE-2020-8174 napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0. | CVSS3: 8.1 | 8% Низкий | больше 6 лет назад |
| CVE-2020-8174 napi_get_value_string_*() allows various kinds of memory corruption in ... | CVSS3: 8.1 | 8% Низкий | больше 6 лет назад |
 | BDU:2020-05054 Уязвимость компонента Cluster: JS module (Node.js) системы управления базами данных Oracle MySQL Cluster, позволяющая нарушителю выполнить произвольный код | CVSS3: 8.1 | 8% Низкий | больше 6 лет назад |
| BDU:2020-04460 Уязвимость функций napi_get_value_string_latin1(), napi_get_value_string_utf8(), napi_get_value_string_utf16() программной платформы Node.js, позволяющая нарушителю выполнить произвольный код | CVSS3: 8.1 | 8% Низкий | больше 6 лет назад |
Уязвимостей на страницу