Vulnerabilities

 60 via 67 paths

Dependencies

 17

Source

 Group 6 Copy Created with Sketch. Docker

Target OS

 alpine:3.9.6
Test your Docker Hub image against our market leading vulnerability database Sign up for free
Severity
  • 1
  • 22
  • 31
  • 6
Status
  • 60
  • 0
  • 0
OS binaries
  • 7
  • 53

critical severity
new

Race Condition

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Race Condition in the vm module with the timeout option. An attacker can access secrets like tokens or passwords to leak or cause data corruption by exploiting a race condition in buffer allocation logic that allows zero-fill toggle to remain disabled when vm module timeouts interrupt execution.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Race Condition vulnerability report

high severity

Use After Free

  • Vulnerable module: node
  • Introduced through: node@12.18.1
  • Fixed in: 12.22.4

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Use After Free on close http2 on stream canceling. An attacker might be able to exploit the memory corruption to change process behaviour.

Remediation

Upgrade node to version 16.6.0, 14.17.4, 12.22.4 or higher.

References

Use After Free vulnerability report

high severity

Uncaught Exception

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in the SignTraits::DeriveBits() function, which incorrectly invokes ThrowException() based on user inputs when executing in a background thread. This allows an attacker to trigger a runtime crash.

Note: The cryptographic operations involved are commonly applied to untrusted input.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade node to version 20.19.2, 22.15.1, 23.11.1, 24.0.2 or higher.

References

Uncaught Exception vulnerability report

high severity
new

Uncaught Exception

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception due to the unhandled TLSSocket error ECONNRESET. An attacker can cause application crash by passing malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data.

Note:

This issue primary affects applications without explicit error handlers to secure sockets.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Uncaught Exception vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: node
  • Introduced through: node@12.18.1
  • Fixed in: 12.19.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Denial of Service (DoS). If more than one ttls is returned than the maximum provided by the requestor, then the *naddrttls response would be larger than the actual number of elements in the addrttls array. An attacker could abuse this to trigger a DNS request for a host of their choice could trigger a Denial of Service by getting the application to resolve a DNS record with a larger number of responses.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade node to version 12.19.1, 14.15.1, 15.2.1 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Privilege Escalation

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Privilege Escalation under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH variable hijacking and DLL hijacking.

Remediation

Upgrade node to version 16.4.1, 14.17.2, 12.22.2 or higher.

References

Privilege Escalation vulnerability report

high severity

Directory Traversal

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Directory Traversal in the path.join function. An attacker can bypass the path traversal protection and access restricted files by crafting specific path inputs that leverage Windows reserved driver names such as CON, PRN, and AUX.

Note: This issue only affects Windows systems and is a result of an incomplete fix for CVE-2025-23084

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade node to version 20.19.4, 22.17.1, 24.4.1 or higher.

References

Directory Traversal vulnerability report

high severity

Out-of-bounds Read

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Out-of-bounds Read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes.

Remediation

Upgrade node to version 16.4.1, 14.17.2, 12.22.2 or higher.

References

Out-of-bounds Read vulnerability report

high severity

Prototype Pollution

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Prototype Pollution via console.table properties. Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be __proto__. Note: This vulnerability only allows an empty string to be assigned numerical keys of the object prototype.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

  • Unsafe Object recursive merge

  • Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type Origin Short description
Denial of service (DoS) Client This is the most likely attack.
DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf).
The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service.
For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution Client Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection Client The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

  • Application server

  • Web server

  • Web browser

How to prevent

  1. Freeze the prototype— use Object.freeze (Object.prototype).

  2. Require schema validation of JSON input.

  3. Avoid using unsafe recursive merge functions.

  4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

  5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade node to version 12.22.9, 14.18.3, 16.13.2, 17.3.1 or higher.

References

Prototype Pollution vulnerability report

high severity
new

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

  • Vulnerable module: node
  • Introduced through: node@12.18.1
  • Fixed in: 20.20.0

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Reliance on Undefined, Unspecified, or Implementation-Defined Behavior due to a flaw in error handling when async_hooks (or AsyncLocalStorage) is enabled. Normally, a "Maximum call stack size exceeded" error (stack overflow) is catchable by try-catch blocks or uncaughtException handlers. However, if this error occurs while an async_hooks callback is on the stack (which happens frequently in frameworks like Next.js or when using APM tools), Node.js treats it as a fatal error. Remote attackers can trigger this crash by sending payloads that cause deep recursion (e.g., deeply nested JSON objects), leading to a Denial of Service.

Notes:

  1. Node.js 24.x and 25.x are less affected if using only AsyncLocalStorage, as they use a newer V8 feature that avoids this hook mechanism;

  2. The patch improves recoverability in one edge case, but it does not remove the broader risk. Recovery from space exhaustion is unspecified, best‑effort behavior and is not a reliable basis for availability or security.

PoC

import { createHook } from 'node:async_hooks';

// This simulates what APM tools do
createHook({ init() {} }).enable();

function recursive() {
  new Promise(() => {}); // Creates async context
  return recursive();
}

try {
  recursive();
} catch (err) {
  console.log('This never runs', err);
}

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior vulnerability report

high severity

Code Injection

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Code Injection due to the incorrect handling of environment variables on Linux when the process is running with elevated privileges that the current user lacks (does not apply to CAP_NET_BIND_SERVICE).

Remediation

Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher.

References

Code Injection vulnerability report

high severity
new

UNIX Symbolic Link (Symlink) Following

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to UNIX Symbolic Link (Symlink) Following in the fs.symlink() function. An attacker can escape the allowed path and read/write sensitive files by chaining directories and symlinks, bypassing --allow-fs-read and --allow-fs-write restrictions.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

UNIX Symbolic Link (Symlink) Following vulnerability report

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a lack of safeguards on chunk extension bytes. The server may read an unbounded number of bytes from a single connection, which allows an attacker to cause denial of service via CPU and network bandwidth exhaustion.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a race condition in Http2Session when nghttp2 data is left in memory after a connection is reset while processing HTTP/2 CONTINUATION frames. An attacker can cause denial of service by sending such frames then triggering the Http2Session destructor.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade node to version 18.20.1, 20.12.1, 21.7.2 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: node
  • Introduced through: node@12.18.1
  • Fixed in: 12.21.0

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Denial of Service (DoS). When too many connection attempts with an HTTP2 unknownProtocol are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening. If no file descriptor limit is configured, then this leads to an excessive memory usage and causes the system to run out of memory.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade node to version 15.10.0, 14.16.0, 12.21.0, 10.24.0 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@12.18.1
  • Fixed in: 12.20.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling. Two copies of a header field are allowed in a HTTP request, which causes Node.js to identifiy the first header and ignore the second.

Remediation

Upgrade node to version 10.23.1, 12.20.1, 14.15.4, 15.5.1 or higher.

References

HTTP Request Smuggling vulnerability report

high severity

Infinite loop

  • Vulnerable module: node
  • Introduced through: node@12.18.1
  • Fixed in: 12.22.11

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Infinite loop via the BN_mod_sqrt() function when parsing certificates. It is possible to trigger this vulnerability by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens before verification of the certificate signature, any process that parses an externally supplied certificate may be subject to a denial of service attack.

Remediation

Upgrade node to version 12.22.11, 14.19.1, 16.14.2, 17.7.2 or higher.

References

Infinite loop vulnerability report

high severity

Integer Overflow or Wraparound

  • Vulnerable module: openssl/libcrypto1.1
  • Introduced through: openssl/libcrypto1.1@1.1.1g-r0 and openssl/libssl1.1@1.1.1g-r0
  • Fixed in: 1.1.1j-r0

Detailed paths

  • Introduced through: mhart/alpine-node@12.18.1 › openssl/libcrypto1.1@1.1.1g-r0
  • Introduced through: mhart/alpine-node@12.18.1 › openssl/libssl1.1@1.1.1g-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.9 relevant fixed versions and status.

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade Alpine:3.9 openssl to version 1.1.1j-r0 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Improper Certificate Validation

  • Vulnerable module: node
  • Introduced through: node@12.18.1
  • Fixed in: 12.22.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Certificate Validation. There is insufficient verification of a certificate chain when using the X509_V_FLAG_X509_STRICT flag.

Remediation

Upgrade node to version 15.14.0, 14.16.1, 12.22.1, 10.24.1 or higher.

References

Improper Certificate Validation vulnerability report

high severity

Use After Free

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Use After Free on close http2 on stream canceling. An attacker might be able to exploit the memory corruption to change process behaviour.

The issue follows on from CVE-2021-22930 as the fix for it did not completely resolve the vulnerability.

Remediation

Upgrade node to version 16.6.2, 14.17.5, 12.22.5 or higher.

References

Use After Free vulnerability report

high severity

Improper Certificate Validation

  • Vulnerable module: openssl/libcrypto1.1
  • Introduced through: openssl/libcrypto1.1@1.1.1g-r0 and openssl/libssl1.1@1.1.1g-r0
  • Fixed in: 1.1.1k-r0

Detailed paths

  • Introduced through: mhart/alpine-node@12.18.1 › openssl/libcrypto1.1@1.1.1g-r0
  • Introduced through: mhart/alpine-node@12.18.1 › openssl/libssl1.1@1.1.1g-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.9 relevant fixed versions and status.

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).

Remediation

Upgrade Alpine:3.9 openssl to version 1.1.1k-r0 or higher.

References

Improper Certificate Validation vulnerability report

high severity

Server-Side Request Forgery (SSRF)

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) due to the handling of the hostname_ascii variable in the uv_getaddrinfo function. Attackers can exploit the creation of addresses that bypass developer checks and resolve to unintended IP addresses, to access internal APIs or for websites that allow users to have username.example.com pages, potentially exposing internal services to attacks.

Notes:

  1. Depending on the build and runtime environment, it can lead to different exploitation scenarios:

The last byte of the hostname is a random value (0-256) but identical in successive calls, and the subsequent byte is a null byte. This situation can be exploited through brute force, especially in production environments where many Node.js instances run in parallel (pm2, kubernetes, etc).

Since the last byte is random, there are cases where it's one of 0-9a-f, which makes 16 possible cases (out of 256) useful for calling localhost (127.0.0.x) and potentially bypassing security measures on internal APIs. The same is true for calling other IP-ranges.

  1. When deployed in an environment with multiple pods (e.g., Kubernetes), is vulnerable to the attack described above, potentially allowing unauthorized access to internal APIs.

Remediation

Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher.

References

Server-Side Request Forgery (SSRF) vulnerability report

high severity

Improper Control of Generation of Code ('Code Injection')

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') due to the improper handling of batch files in child_process.spawn or child_process.spawnSync. An attacker can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Note: This vulnerability only affects Windows machines.

Remediation

Upgrade node to version 18.20.2, 20.12.2, 21.7.3 or higher.

References

Improper Control of Generation of Code ('Code Injection') vulnerability report

medium severity

Access Restriction Bypass

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Access Restriction Bypass by embedding non-network imports in data URLs. Exploiting this vulnerability allows an attacker to execute arbitrary code, compromising system security.

Remediation

Upgrade node to version 18.20.4, 20.15.1, 22.4.1 or higher.

References

Access Restriction Bypass vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the ReadFileUtf8 internal binding, which fails to clean up pointers in uv_fs_s.file. UTF-16 path buffers leak memory, which can lead to denial of service.

Note:

CVE-2025-23122 is a duplicate of this vulnerability.

Remediation

Upgrade node to version 20.19.2, 22.15.1 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling in the llhttp implementation, when handing HTTP/1 headers terminated with \r\n\rX instead of the required \r\n\r\n. This allows attackers to bypass proxy-based access controls and submit unauthorized requests.

Remediation

Upgrade node to version 20.19.2 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

Improper Control of Generation of Code ('Code Injection')

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection'). This is due to a bypass of CVE-2024-27980.

A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Note: This vulnerability affects only users of child_process.spawn and child_process.spawnSync on Windows in all active release lines.

Remediation

Upgrade node to version 18.20.4, 20.15.1, 22.4.1 or higher.

References

Improper Control of Generation of Code ('Code Injection') vulnerability report

medium severity

Buffer Overflow

  • Vulnerable module: node
  • Introduced through: node@12.18.1
  • Fixed in: 12.18.4

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Buffer Overflow. realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow.

Remediation

Upgrade node to version 10.22.1, 12.18.4, 14.9.0 or higher.

References

Buffer Overflow vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling via llhttp. The HTTP parser accepts requests with a space (SP) right after the header name before the colon.

Remediation

Upgrade node to version 12.22.7, 14.18.1, 16.11.1 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling via llhttp. The parse ignores chunk extensions when parsing the body of chunked requests.

Remediation

Upgrade node to version 12.22.7, 14.18.1, 16.11.1 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling when the llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers.

Remediation

Upgrade node to version 14.20.0, 16.16.0, 18.5.0 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling. The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers.

Remediation

Upgrade node to version 14.20.0, 16.16.0, 18.5.0 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling. when the llhttp parser in the http module does not adequately delimit HTTP requests with CRLF sequences.

Remediation

Upgrade node to version 14.20.0, 16.16.0, 18.5.0 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity
new

Uncaught Exception

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in the TLS module when a TLS server is configured with pskCallback or ALPNCallback. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Uncaught Exception vulnerability report

medium severity

DLL Hijacking

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to DLL Hijacking. on Windows based systems running OpenSSL that use a C:\Program Files\Common Files\SSL\openssl.cnf file. Attackers could place a malicious providers.dll file at one of the locations checked according to DLL Search Order and it would be used by the application.

Remediation

Upgrade node to version 14.20.0, 16.16.0, 18.5.0 or higher.

References

DLL Hijacking vulnerability report

medium severity

DNS Rebinding

  • Vulnerable module: node
  • Introduced through: node@12.18.1
  • Fixed in: 12.21.0

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to DNS Rebinding. A Denial of Service can occur when the whitelist in /etc/hosts includes localhost6. If an attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the localhost6 domain.

Remediation

Upgrade node to version 15.10.0, 14.16.0, 12.21.0, 10.24.0 or higher.

References

DNS Rebinding vulnerability report

medium severity

DNS Rebinding

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to DNS Rebinding by bypassing IsAllowedHost because IsIPAddress does not properly check if an IP address is invalid or not. This vulnerability is a bypass of CVE-2021-22884.

Remediation

Upgrade node to version 14.20.0, 16.16.0, 18.5.0 or higher.

References

DNS Rebinding vulnerability report

medium severity

NULL Pointer Dereference

  • Vulnerable module: node
  • Introduced through: node@12.18.1
  • Fixed in: 12.22.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to NULL Pointer Dereference. If sent a maliciously crafted renegotiation ClientHello message from a client, an OpenSSL TLS server may crash. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a Denial of Service.

Remediation

Upgrade node to version 15.14.0, 14.16.1, 12.22.1, 10.24.1 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Observable Timing Discrepancy

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Observable Timing Discrepancy due to the implementation of PKCS#1 v1.5 padding. An attacker can infer the private key used in the cryptographic operation by observing the time taken to execute cryptographic operations (Marvin).

Remediation

Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher.

References

Observable Timing Discrepancy vulnerability report

medium severity

Use After Free

  • Vulnerable module: node
  • Introduced through: node@12.18.1
  • Fixed in: 12.20.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Use After Free. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory.

Remediation

Upgrade node to version 10.23.1, 12.20.1, 14.15.4, 15.5.1 or higher.

References

Use After Free vulnerability report

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: openssl/libcrypto1.1
  • Introduced through: openssl/libcrypto1.1@1.1.1g-r0 and openssl/libssl1.1@1.1.1g-r0
  • Fixed in: 1.1.1j-r0

Detailed paths

  • Introduced through: mhart/alpine-node@12.18.1 › openssl/libcrypto1.1@1.1.1g-r0
  • Introduced through: mhart/alpine-node@12.18.1 › openssl/libssl1.1@1.1.1g-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.9 relevant fixed versions and status.

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade Alpine:3.9 openssl to version 1.1.1j-r0 or higher.

References

Integer Overflow or Wraparound vulnerability report

medium severity

NULL Pointer Dereference

  • Vulnerable module: openssl/libcrypto1.1
  • Introduced through: openssl/libcrypto1.1@1.1.1g-r0 and openssl/libssl1.1@1.1.1g-r0
  • Fixed in: 1.1.1k-r0

Detailed paths

  • Introduced through: mhart/alpine-node@12.18.1 › openssl/libcrypto1.1@1.1.1g-r0
  • Introduced through: mhart/alpine-node@12.18.1 › openssl/libssl1.1@1.1.1g-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.9 relevant fixed versions and status.

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

Remediation

Upgrade Alpine:3.9 openssl to version 1.1.1k-r0 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

NULL Pointer Dereference

  • Vulnerable module: openssl/libcrypto1.1
  • Introduced through: openssl/libcrypto1.1@1.1.1g-r0 and openssl/libssl1.1@1.1.1g-r0
  • Fixed in: 1.1.1i-r0

Detailed paths

  • Introduced through: mhart/alpine-node@12.18.1 › openssl/libcrypto1.1@1.1.1g-r0
  • Introduced through: mhart/alpine-node@12.18.1 › openssl/libssl1.1@1.1.1g-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.9 relevant fixed versions and status.

The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).

Remediation

Upgrade Alpine:3.9 openssl to version 1.1.1i-r0 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Out-of-bounds Write

  • Vulnerable module: musl/musl
  • Introduced through: musl/musl@1.1.20-r5 and musl/musl-utils@1.1.20-r5
  • Fixed in: 1.1.20-r6

Detailed paths

  • Introduced through: mhart/alpine-node@12.18.1 › musl/musl@1.1.20-r5
  • Introduced through: mhart/alpine-node@12.18.1 › musl/musl-utils@1.1.20-r5

NVD Description

Note: Versions mentioned in the description apply only to the upstream musl package and not the musl package as distributed by Alpine. See How to fix? for Alpine:3.9 relevant fixed versions and status.

In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstrated by an invalid write access (buffer overflow).

Remediation

Upgrade Alpine:3.9 musl to version 1.1.20-r6 or higher.

References

Out-of-bounds Write vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling via content length ofuscation. An attacker can smuggle an HTTP request by including a space before a Content-Length header.

Remediation

Upgrade node to version 18.20.1, 20.12.1, 21.7.2 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

Improper Certificate Validation

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Certificate Validation which is not handling multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects in order to inject a Common Name that would allow bypassing the certificate subject verification.

Remediation

Upgrade node to version 12.22.9, 14.18.3, 16.13.2, 17.3.1 or higher.

References

Improper Certificate Validation vulnerability report

medium severity

Improper Certificate Validation

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Certificate Validation via string injection. Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.

Remediation

Upgrade node to version 12.22.9, 14.18.3, 16.13.2, 17.3.1 or higher.

References

Improper Certificate Validation vulnerability report

medium severity

Improper Handling of URL Encoding

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Handling of URL Encoding via Subject Alternative Name (SAN) types, which PKIs are not defined to use. That, can result in bypassing name-constrained intermediates. Additionally, when a protocol allows URI SANs, node does not match the URI correctly.

Remediation

Upgrade node to version 12.22.9, 14.18.3, 16.13.2, 17.3.1 or higher.

References

Improper Handling of URL Encoding vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Input Validation. If the Node.js https API was used incorrectly and undefined was in passed for the rejectUnauthorized parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

Remediation

Upgrade node to version 16.6.2, 14.17.5, 12.22.5 or higher.

References

Improper Input Validation vulnerability report

medium severity

Inconsistency Between Implementation and Documented Design

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Inconsistency Between Implementation and Documented Design where the generateKeys() API function returned from crypto.createDiffieHellman() do not generate keys after setting a private key.

Remediation

Upgrade node to version 16.20.1, 18.16.1, 20.3.1 or higher.

References

Inconsistency Between Implementation and Documented Design vulnerability report

medium severity

Information Exposure

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Information Exposure in the aesni_ocb_encrypt and aesni_ocb_decrypt, which reveal 16 unencrypted bytes of memory.

NOTE: Implementations using TLS or DTLS are not affected by this vulnerability.

Remediation

Upgrade node to version 14.20.0, 16.16.0, 18.5.0 or higher.

References

Information Exposure vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Input Validation due to missing input validation of host names returned by Domain Name Servers in the Node.js DNS library. It could lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

NOTE: This vulnerability has also been identified as: CVE-2021-3672

Remediation

Upgrade node to version 16.6.2, 14.17.5, 12.22.5 or higher.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Input Validation due to missing input validation of host names returned by Domain Name Servers in the Node.js DNS library. It could lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

NOTE: This vulnerability has also been identified as: CVE-2021-22931

Remediation

Upgrade node to version 16.6.2, 14.17.5, 12.22.5 or higher.

References

Improper Input Validation vulnerability report

medium severity
new

Incorrect Authorization

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Incorrect Authorization in the permission model via the fs.futimes() function due to failing to check for write permissions. A process restricted to "read-only" access can still modify a file's access and modification timestamps. While it doesn't allow changing the file's content, it can be used to obscure malicious activity by tampering with audit logs or metadata.

Note:

This is only exploitable if the attacker already has the ability to execute code on the system (within the restricted Node.js environment).

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Incorrect Authorization vulnerability report

low severity

Permissive Cross-domain Policy with Untrusted Domains

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains due to not clearing Proxy-Authentication headers on cross-origin redirects. An attacker can intercept the improperly cleared headers.

Remediation

Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher.

References

Permissive Cross-domain Policy with Untrusted Domains vulnerability report

low severity

Buffer Overflow

  • Vulnerable module: node
  • Introduced through: node@12.18.1
  • Fixed in: 12.21.0

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Buffer Overflow. Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash.

Remediation

Upgrade node to version 15.10.0, 14.16.0, 12.21.0, 10.24.0 or higher.

References

Buffer Overflow vulnerability report

low severity

Inadequate Encryption Strength

  • Vulnerable module: openssl/libcrypto1.1
  • Introduced through: openssl/libcrypto1.1@1.1.1g-r0 and openssl/libssl1.1@1.1.1g-r0
  • Fixed in: 1.1.1j-r0

Detailed paths

  • Introduced through: mhart/alpine-node@12.18.1 › openssl/libcrypto1.1@1.1.1g-r0
  • Introduced through: mhart/alpine-node@12.18.1 › openssl/libssl1.1@1.1.1g-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.9 relevant fixed versions and status.

OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that support SSL or TLS versions greater than SSLv2 are supposed to use a special form of padding. A server that supports greater than SSLv2 is supposed to reject connection attempts from a client where this special form of padding is present, because this indicates that a version rollback has occurred (i.e. both client and server support greater than SSLv2, and yet this is the version that is being requested). The implementation of this padding check inverted the logic so that the connection attempt is accepted if the padding is present, and rejected if it is absent. This means that such as server will accept a connection if a version rollback attack has occurred. Further the server will erroneously reject a connection if a normal SSLv2 connection attempt is made. Only OpenSSL 1.0.2 servers from version 1.0.2s to 1.0.2x are affected by this issue. In order to be vulnerable a 1.0.2 server must: 1) have configured SSLv2 support at compile time (this is off by default), 2) have configured SSLv2 support at runtime (this is off by default), 3) have configured SSLv2 ciphersuites (these are not in the default ciphersuite list) OpenSSL 1.1.1 does not have SSLv2 support and therefore is not vulnerable to this issue. The underlying error is in the implementation of the RSA_padding_check_SSLv23() function. This also affects the RSA_SSLV23_PADDING padding mode used by various other functions. Although 1.1.1 does not support SSLv2 the RSA_padding_check_SSLv23() function still exists, as does the RSA_SSLV23_PADDING padding mode. Applications that directly call that function or use that padding mode will encounter this issue. However since there is no support for the SSLv2 protocol in 1.1.1 this is considered a bug and not a security issue in that version. OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.0.2y (Affected 1.0.2s-1.0.2x).

Remediation

Upgrade Alpine:3.9 openssl to version 1.1.1j-r0 or higher.

References

Inadequate Encryption Strength vulnerability report

low severity

Authorization Bypass

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Authorization Bypass via fs.fchown or fs.fchmod operations which can use a "read-only" file descriptor to change the owner and permissions of a file.

Note: This is only exploitable for users using the experimental permission when the --allow-fs-write flag is used

Remediation

Upgrade node to version 20.15.1, 22.4.1 or higher.

References

Authorization Bypass vulnerability report

low severity

Authorization Bypass

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Authorization Bypass due to a failure to restrict file stats through the fs.lstat API that allows attackers to retrieve stats from files to which they do not have explicit read access.

Note: This is exploitable only for users of the experimental permission model when the --allow-fs-read flag is used.

Remediation

Upgrade node to version 20.15.1, 22.4.1 or higher.

References

Authorization Bypass vulnerability report

low severity

Improper Handling of Values

  • Vulnerable module: node
  • Introduced through: node@12.18.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@12.18.1 › node@12.18.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Handling of Values. This is because the Permission Model assumes wrongly that any path starting with two backslashes \ has a four-character prefix that can be ignored.

Note: This vulnerability affects only Windows users of the Node.js Permission Model

Remediation

Upgrade node to version 20.15.1, 22.4.1 or higher.

References

Improper Handling of Values vulnerability report