Поиск уязвимостей

Security update for nodejs14

Security update for nodejs12

Security update for nodejs16

Security update for nodejs16

Security update for nodejs16

ALT-PU-2024-5094: package `node` update to version 20.12.1-alt1

Security update for nodejs18

Security update for nodejs18

Security update for nodejs20

Important: nodejs security update

Important: nodejs:20 security update

Important: nodejs:18 security update

Important: nodejs:18 security update

Important: nodejs:20 security update

ELSA-2024-2910: nodejs security update (IMPORTANT)

ELSA-2024-2853: nodejs:20 security update (IMPORTANT)

ELSA-2024-2780: nodejs:18 security update (IMPORTANT)

ELSA-2024-2779: nodejs:18 security update (IMPORTANT)

ELSA-2024-2778: nodejs:20 security update (IMPORTANT)

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.