Vulnerabilities

 53 via 59 paths

Dependencies

 14

Source

 Group 6 Copy Created with Sketch. Docker

Target OS

 alpine:3.4.6
Test your Docker Hub image against our market leading vulnerability database Sign up for free
Severity
  • 1
  • 17
  • 31
  • 4
Status
  • 53
  • 0
  • 0
OS binaries
  • 6
  • 47

critical severity
new

Race Condition

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Race Condition in the vm module with the timeout option. An attacker can access secrets like tokens or passwords to leak or cause data corruption by exploiting a race condition in buffer allocation logic that allows zero-fill toggle to remain disabled when vm module timeouts interrupt execution.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Race Condition vulnerability report

high severity

Uncaught Exception

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in the SignTraits::DeriveBits() function, which incorrectly invokes ThrowException() based on user inputs when executing in a background thread. This allows an attacker to trigger a runtime crash.

Note: The cryptographic operations involved are commonly applied to untrusted input.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade node to version 20.19.2, 22.15.1, 23.11.1, 24.0.2 or higher.

References

Uncaught Exception vulnerability report

high severity
new

Uncaught Exception

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception due to the unhandled TLSSocket error ECONNRESET. An attacker can cause application crash by passing malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data.

Note:

This issue primary affects applications without explicit error handlers to secure sockets.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Uncaught Exception vulnerability report

high severity

Privilege Escalation

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Privilege Escalation under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH variable hijacking and DLL hijacking.

Remediation

Upgrade node to version 16.4.1, 14.17.2, 12.22.2 or higher.

References

Privilege Escalation vulnerability report

high severity

Directory Traversal

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Directory Traversal in the path.join function. An attacker can bypass the path traversal protection and access restricted files by crafting specific path inputs that leverage Windows reserved driver names such as CON, PRN, and AUX.

Note: This issue only affects Windows systems and is a result of an incomplete fix for CVE-2025-23084

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade node to version 20.19.4, 22.17.1, 24.4.1 or higher.

References

Directory Traversal vulnerability report

high severity

Out-of-bounds Read

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Out-of-bounds Read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes.

Remediation

Upgrade node to version 16.4.1, 14.17.2, 12.22.2 or higher.

References

Out-of-bounds Read vulnerability report

high severity

Prototype Pollution

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Prototype Pollution via console.table properties. Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be __proto__. Note: This vulnerability only allows an empty string to be assigned numerical keys of the object prototype.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

  • Unsafe Object recursive merge

  • Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type Origin Short description
Denial of service (DoS) Client This is the most likely attack.
DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf).
The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service.
For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution Client Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection Client The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

  • Application server

  • Web server

  • Web browser

How to prevent

  1. Freeze the prototype— use Object.freeze (Object.prototype).

  2. Require schema validation of JSON input.

  3. Avoid using unsafe recursive merge functions.

  4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

  5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Oliver. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade node to version 12.22.9, 14.18.3, 16.13.2, 17.3.1 or higher.

References

Prototype Pollution vulnerability report

high severity

Code Injection

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Code Injection due to the incorrect handling of environment variables on Linux when the process is running with elevated privileges that the current user lacks (does not apply to CAP_NET_BIND_SERVICE).

Remediation

Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher.

References

Code Injection vulnerability report

high severity
new

UNIX Symbolic Link (Symlink) Following

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to UNIX Symbolic Link (Symlink) Following in the fs.symlink() function. An attacker can escape the allowed path and read/write sensitive files by chaining directories and symlinks, bypassing --allow-fs-read and --allow-fs-write restrictions.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

UNIX Symbolic Link (Symlink) Following vulnerability report

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a lack of safeguards on chunk extension bytes. The server may read an unbounded number of bytes from a single connection, which allows an attacker to cause denial of service via CPU and network bandwidth exhaustion.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to a race condition in Http2Session when nghttp2 data is left in memory after a connection is reset while processing HTTP/2 CONTINUATION frames. An attacker can cause denial of service by sending such frames then triggering the Http2Session destructor.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade node to version 18.20.1, 20.12.1, 21.7.2 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling. Two copies of a header field are allowed in a HTTP request, which causes Node.js to identifiy the first header and ignore the second.

Remediation

Upgrade node to version 10.23.1, 12.20.1, 14.15.4, 15.5.1 or higher.

References

HTTP Request Smuggling vulnerability report

high severity

Key Management Errors

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Key Management Errors. During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack.

Remediation

Upgrade node to version 10.9.0 or higher.

References

Key Management Errors vulnerability report

high severity

Key Management Errors

  • Vulnerable module: openssl/libcrypto1.0
  • Introduced through: openssl/libcrypto1.0@1.0.2n-r0 and openssl/libssl1.0@1.0.2n-r0
  • Fixed in: 1.0.2o-r1

Detailed paths

  • Introduced through: mhart/alpine-node@4 › openssl/libcrypto1.0@1.0.2n-r0
  • Introduced through: mhart/alpine-node@4 › openssl/libssl1.0@1.0.2n-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.4 relevant fixed versions and status.

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

Remediation

Upgrade Alpine:3.4 openssl to version 1.0.2o-r1 or higher.

References

Key Management Errors vulnerability report

high severity

Improper Certificate Validation

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Certificate Validation. There is insufficient verification of a certificate chain when using the X509_V_FLAG_X509_STRICT flag.

Remediation

Upgrade node to version 15.14.0, 14.16.1, 12.22.1, 10.24.1 or higher.

References

Improper Certificate Validation vulnerability report

high severity

Use After Free

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Use After Free on close http2 on stream canceling. An attacker might be able to exploit the memory corruption to change process behaviour.

The issue follows on from CVE-2021-22930 as the fix for it did not completely resolve the vulnerability.

Remediation

Upgrade node to version 16.6.2, 14.17.5, 12.22.5 or higher.

References

Use After Free vulnerability report

high severity

Server-Side Request Forgery (SSRF)

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) due to the handling of the hostname_ascii variable in the uv_getaddrinfo function. Attackers can exploit the creation of addresses that bypass developer checks and resolve to unintended IP addresses, to access internal APIs or for websites that allow users to have username.example.com pages, potentially exposing internal services to attacks.

Notes:

  1. Depending on the build and runtime environment, it can lead to different exploitation scenarios:

The last byte of the hostname is a random value (0-256) but identical in successive calls, and the subsequent byte is a null byte. This situation can be exploited through brute force, especially in production environments where many Node.js instances run in parallel (pm2, kubernetes, etc).

Since the last byte is random, there are cases where it's one of 0-9a-f, which makes 16 possible cases (out of 256) useful for calling localhost (127.0.0.x) and potentially bypassing security measures on internal APIs. The same is true for calling other IP-ranges.

  1. When deployed in an environment with multiple pods (e.g., Kubernetes), is vulnerable to the attack described above, potentially allowing unauthorized access to internal APIs.

Remediation

Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher.

References

Server-Side Request Forgery (SSRF) vulnerability report

high severity

Improper Control of Generation of Code ('Code Injection')

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') due to the improper handling of batch files in child_process.spawn or child_process.spawnSync. An attacker can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Note: This vulnerability only affects Windows machines.

Remediation

Upgrade node to version 18.20.2, 20.12.2, 21.7.3 or higher.

References

Improper Control of Generation of Code ('Code Injection') vulnerability report

medium severity

Access Restriction Bypass

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Access Restriction Bypass by embedding non-network imports in data URLs. Exploiting this vulnerability allows an attacker to execute arbitrary code, compromising system security.

Remediation

Upgrade node to version 18.20.4, 20.15.1, 22.4.1 or higher.

References

Access Restriction Bypass vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the ReadFileUtf8 internal binding, which fails to clean up pointers in uv_fs_s.file. UTF-16 path buffers leak memory, which can lead to denial of service.

Note:

CVE-2025-23122 is a duplicate of this vulnerability.

Remediation

Upgrade node to version 20.19.2, 22.15.1 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling in the llhttp implementation, when handing HTTP/1 headers terminated with \r\n\rX instead of the required \r\n\r\n. This allows attackers to bypass proxy-based access controls and submit unauthorized requests.

Remediation

Upgrade node to version 20.19.2 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

Improper Control of Generation of Code ('Code Injection')

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection'). This is due to a bypass of CVE-2024-27980.

A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Note: This vulnerability affects only users of child_process.spawn and child_process.spawnSync on Windows in all active release lines.

Remediation

Upgrade node to version 18.20.4, 20.15.1, 22.4.1 or higher.

References

Improper Control of Generation of Code ('Code Injection') vulnerability report

medium severity

Buffer Overflow

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Buffer Overflow. realpath() implementation performs an incorrect calculation when allocating a buffer, leading to a potential buffer overflow.

Remediation

Upgrade node to version 10.22.1, 12.18.4, 14.9.0 or higher.

References

Buffer Overflow vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling via llhttp. The HTTP parser accepts requests with a space (SP) right after the header name before the colon.

Remediation

Upgrade node to version 12.22.7, 14.18.1, 16.11.1 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling via llhttp. The parse ignores chunk extensions when parsing the body of chunked requests.

Remediation

Upgrade node to version 12.22.7, 14.18.1, 16.11.1 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling when the llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers.

Remediation

Upgrade node to version 14.20.0, 16.16.0, 18.5.0 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling. The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers.

Remediation

Upgrade node to version 14.20.0, 16.16.0, 18.5.0 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling. when the llhttp parser in the http module does not adequately delimit HTTP requests with CRLF sequences.

Remediation

Upgrade node to version 14.20.0, 16.16.0, 18.5.0 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

Uncontrolled Recursion

  • Vulnerable module: openssl/libcrypto1.0
  • Introduced through: openssl/libcrypto1.0@1.0.2n-r0 and openssl/libssl1.0@1.0.2n-r0
  • Fixed in: 1.0.2o-r0

Detailed paths

  • Introduced through: mhart/alpine-node@4 › openssl/libcrypto1.0@1.0.2n-r0
  • Introduced through: mhart/alpine-node@4 › openssl/libssl1.0@1.0.2n-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.4 relevant fixed versions and status.

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).

Remediation

Upgrade Alpine:3.4 openssl to version 1.0.2o-r0 or higher.

References

Uncontrolled Recursion vulnerability report

medium severity
new

Uncaught Exception

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in the TLS module when a TLS server is configured with pskCallback or ALPNCallback. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Uncaught Exception vulnerability report

medium severity

DLL Hijacking

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to DLL Hijacking. on Windows based systems running OpenSSL that use a C:\Program Files\Common Files\SSL\openssl.cnf file. Attackers could place a malicious providers.dll file at one of the locations checked according to DLL Search Order and it would be used by the application.

Remediation

Upgrade node to version 14.20.0, 16.16.0, 18.5.0 or higher.

References

DLL Hijacking vulnerability report

medium severity

DNS Rebinding

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to DNS Rebinding by bypassing IsAllowedHost because IsIPAddress does not properly check if an IP address is invalid or not. This vulnerability is a bypass of CVE-2021-22884.

Remediation

Upgrade node to version 14.20.0, 16.16.0, 18.5.0 or higher.

References

DNS Rebinding vulnerability report

medium severity

NULL Pointer Dereference

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to NULL Pointer Dereference. If sent a maliciously crafted renegotiation ClientHello message from a client, an OpenSSL TLS server may crash. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a Denial of Service.

Remediation

Upgrade node to version 15.14.0, 14.16.1, 12.22.1, 10.24.1 or higher.

References

NULL Pointer Dereference vulnerability report

medium severity

Observable Timing Discrepancy

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Observable Timing Discrepancy due to the implementation of PKCS#1 v1.5 padding. An attacker can infer the private key used in the cryptographic operation by observing the time taken to execute cryptographic operations (Marvin).

Remediation

Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher.

References

Observable Timing Discrepancy vulnerability report

medium severity

Use After Free

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Use After Free. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory.

Remediation

Upgrade node to version 10.23.1, 12.20.1, 14.15.4, 15.5.1 or higher.

References

Use After Free vulnerability report

medium severity

CVE-2018-0733

  • Vulnerable module: openssl/libcrypto1.0
  • Introduced through: openssl/libcrypto1.0@1.0.2n-r0 and openssl/libssl1.0@1.0.2n-r0
  • Fixed in: 1.0.2o-r0

Detailed paths

  • Introduced through: mhart/alpine-node@4 › openssl/libcrypto1.0@1.0.2n-r0
  • Introduced through: mhart/alpine-node@4 › openssl/libssl1.0@1.0.2n-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.4 relevant fixed versions and status.

Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g).

Remediation

Upgrade Alpine:3.4 openssl to version 1.0.2o-r0 or higher.

References

CVE-2018-0733 vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: openssl/libcrypto1.0
  • Introduced through: openssl/libcrypto1.0@1.0.2n-r0 and openssl/libssl1.0@1.0.2n-r0
  • Fixed in: 1.0.2q-r0

Detailed paths

  • Introduced through: mhart/alpine-node@4 › openssl/libcrypto1.0@1.0.2n-r0
  • Introduced through: mhart/alpine-node@4 › openssl/libssl1.0@1.0.2n-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.4 relevant fixed versions and status.

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

Remediation

Upgrade Alpine:3.4 openssl to version 1.0.2q-r0 or higher.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

  • Vulnerable module: openssl/libcrypto1.0
  • Introduced through: openssl/libcrypto1.0@1.0.2n-r0 and openssl/libssl1.0@1.0.2n-r0
  • Fixed in: 1.0.2o-r2

Detailed paths

  • Introduced through: mhart/alpine-node@4 › openssl/libcrypto1.0@1.0.2n-r0
  • Introduced through: mhart/alpine-node@4 › openssl/libssl1.0@1.0.2n-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.4 relevant fixed versions and status.

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).

Remediation

Upgrade Alpine:3.4 openssl to version 1.0.2o-r2 or higher.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling via content length ofuscation. An attacker can smuggle an HTTP request by including a space before a Content-Length header.

Remediation

Upgrade node to version 18.20.1, 20.12.1, 21.7.2 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

Improper Certificate Validation

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Certificate Validation which is not handling multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects in order to inject a Common Name that would allow bypassing the certificate subject verification.

Remediation

Upgrade node to version 12.22.9, 14.18.3, 16.13.2, 17.3.1 or higher.

References

Improper Certificate Validation vulnerability report

medium severity

Improper Certificate Validation

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Certificate Validation via string injection. Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.

Remediation

Upgrade node to version 12.22.9, 14.18.3, 16.13.2, 17.3.1 or higher.

References

Improper Certificate Validation vulnerability report

medium severity

Improper Handling of URL Encoding

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Handling of URL Encoding via Subject Alternative Name (SAN) types, which PKIs are not defined to use. That, can result in bypassing name-constrained intermediates. Additionally, when a protocol allows URI SANs, node does not match the URI correctly.

Remediation

Upgrade node to version 12.22.9, 14.18.3, 16.13.2, 17.3.1 or higher.

References

Improper Handling of URL Encoding vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Input Validation. If the Node.js https API was used incorrectly and undefined was in passed for the rejectUnauthorized parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

Remediation

Upgrade node to version 16.6.2, 14.17.5, 12.22.5 or higher.

References

Improper Input Validation vulnerability report

medium severity

Inconsistency Between Implementation and Documented Design

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Inconsistency Between Implementation and Documented Design where the generateKeys() API function returned from crypto.createDiffieHellman() do not generate keys after setting a private key.

Remediation

Upgrade node to version 16.20.1, 18.16.1, 20.3.1 or higher.

References

Inconsistency Between Implementation and Documented Design vulnerability report

medium severity

Information Exposure

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Information Exposure in the aesni_ocb_encrypt and aesni_ocb_decrypt, which reveal 16 unencrypted bytes of memory.

NOTE: Implementations using TLS or DTLS are not affected by this vulnerability.

Remediation

Upgrade node to version 14.20.0, 16.16.0, 18.5.0 or higher.

References

Information Exposure vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Input Validation due to missing input validation of host names returned by Domain Name Servers in the Node.js DNS library. It could lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

NOTE: This vulnerability has also been identified as: CVE-2021-3672

Remediation

Upgrade node to version 16.6.2, 14.17.5, 12.22.5 or higher.

References

Improper Input Validation vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Input Validation due to missing input validation of host names returned by Domain Name Servers in the Node.js DNS library. It could lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

NOTE: This vulnerability has also been identified as: CVE-2021-22931

Remediation

Upgrade node to version 16.6.2, 14.17.5, 12.22.5 or higher.

References

Improper Input Validation vulnerability report

medium severity
new

Incorrect Authorization

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Incorrect Authorization in the permission model via the fs.futimes() function due to failing to check for write permissions. A process restricted to "read-only" access can still modify a file's access and modification timestamps. While it doesn't allow changing the file's content, it can be used to obscure malicious activity by tampering with audit logs or metadata.

Note:

This is only exploitable if the attacker already has the ability to execute code on the system (within the restricted Node.js environment).

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Incorrect Authorization vulnerability report

medium severity

Information Exposure

  • Vulnerable module: openssl/libcrypto1.0
  • Introduced through: openssl/libcrypto1.0@1.0.2n-r0 and openssl/libssl1.0@1.0.2n-r0
  • Fixed in: 1.0.2q-r0

Detailed paths

  • Introduced through: mhart/alpine-node@4 › openssl/libcrypto1.0@1.0.2n-r0
  • Introduced through: mhart/alpine-node@4 › openssl/libssl1.0@1.0.2n-r0

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Alpine. See How to fix? for Alpine:3.4 relevant fixed versions and status.

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

Remediation

Upgrade Alpine:3.4 openssl to version 1.0.2q-r0 or higher.

References

Information Exposure vulnerability report

low severity

Permissive Cross-domain Policy with Untrusted Domains

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains due to not clearing Proxy-Authentication headers on cross-origin redirects. An attacker can intercept the improperly cleared headers.

Remediation

Upgrade node to version 18.19.1, 20.11.1, 21.6.2 or higher.

References

Permissive Cross-domain Policy with Untrusted Domains vulnerability report

low severity

Authorization Bypass

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Authorization Bypass via fs.fchown or fs.fchmod operations which can use a "read-only" file descriptor to change the owner and permissions of a file.

Note: This is only exploitable for users using the experimental permission when the --allow-fs-write flag is used

Remediation

Upgrade node to version 20.15.1, 22.4.1 or higher.

References

Authorization Bypass vulnerability report

low severity

Authorization Bypass

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Authorization Bypass due to a failure to restrict file stats through the fs.lstat API that allows attackers to retrieve stats from files to which they do not have explicit read access.

Note: This is exploitable only for users of the experimental permission model when the --allow-fs-read flag is used.

Remediation

Upgrade node to version 20.15.1, 22.4.1 or higher.

References

Authorization Bypass vulnerability report

low severity

Improper Handling of Values

  • Vulnerable module: node
  • Introduced through: node@4.9.1

Detailed paths

  • Introduced through: docker-image|mhart/alpine-node@4 › node@4.9.1

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Improper Handling of Values. This is because the Permission Model assumes wrongly that any path starting with two backslashes \ has a four-character prefix that can be ignored.

Note: This vulnerability affects only Windows users of the Node.js Permission Model

Remediation

Upgrade node to version 20.15.1, 22.4.1 or higher.

References

Improper Handling of Values vulnerability report