Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (8)
| Vulnerability |
Summary |
Aliases |
|
VCID-2z1f-7jkw-17av
|
Multiple vulnerabilities have been discovered in Node.js, the worst of which could lead to execution of arbitrary code.
|
CVE-2024-27982
|
|
VCID-9yq7-aba3-c7c3
|
Multiple vulnerabilities have been discovered in Node.js.
|
CVE-2023-32559
|
|
VCID-bx67-aud6-b3fa
|
Multiple vulnerabilities have been discovered in Node.js, the worst of which could lead to execution of arbitrary code.
|
CVE-2024-22025
|
|
VCID-e6gj-fe31-kkh5
|
Multiple vulnerabilities have been discovered in Node.js, the worst of which could lead to execution of arbitrary code.
|
CVE-2023-46809
|
|
VCID-e7u5-356v-jbg7
|
Multiple vulnerabilities have been discovered in Node.js.
|
CVE-2023-30590
|
|
VCID-nenk-4cgd-fugv
|
Multiple vulnerabilities have been discovered in Node.js, the worst of which could lead to execution of arbitrary code.
|
CVE-2024-27983
|
|
VCID-vkvx-gxbu-3uau
|
Multiple vulnerabilities have been discovered in Node.js, the worst of which could lead to execution of arbitrary code.
|
CVE-2024-22019
|
|
VCID-zstw-3wmu-u3c8
|
llhttp vulnerable to HTTP request smuggling
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
|
CVE-2023-30589
GHSA-cggh-pq45-6h9x
|