rpm package
almalinux/nodejs-packaging-bundler
pkg:rpm/almalinux/nodejs-packaging-bundler
Vulnerabilities (95)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-55131 | Hig | 7.1 | < 2021.06-6.module_el8.10.0+4086+70facd4a | 2021.06-6.module_el8.10.0+4086+70facd4a | Jan 20, 2026 | A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Ar | |
| CVE-2025-55130 | Cri | 9.1 | < 2021.06-6.module_el8.10.0+4086+70facd4a | 2021.06-6.module_el8.10.0+4086+70facd4a | Jan 20, 2026 | A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and | |
| CVE-2025-6965 | Hig | 7.7 | < 2021.06-4.module_el8.10.0+3961+6a788e57 | 2021.06-4.module_el8.10.0+3961+6a788e57 | Jul 15, 2025 | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. | |
| CVE-2025-23166 | Hig | 7.5 | < 2021.06-4.module_el9.5.0+139+09296491 | 2021.06-4.module_el9.5.0+139+09296491 | May 19, 2025 | The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentiall | |
| CVE-2025-3277 | Cri | 9.8 | < 2021.06-4.module_el8.10.0+3961+6a788e57 | 2021.06-4.module_el8.10.0+3961+6a788e57 | Apr 14, 2025 | An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of | |
| CVE-2025-31498 | Hig | — | < 2021.06-4.module_el8.10.0+3961+6a788e57 | 2021.06-4.module_el8.10.0+3961+6a788e57 | Apr 8, 2025 | c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queri | |
| CVE-2025-23085 | Med | 5.3 | < 2021.06-4.module_el8.10.0+3958+472a6467 | 2021.06-4.module_el8.10.0+3958+472a6467 | Feb 7, 2025 | A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to inc | |
| CVE-2025-23083 | Hig | 7.7 | < 2021.06-4.module_el8.10.0+3958+472a6467 | 2021.06-4.module_el8.10.0+3958+472a6467 | Jan 22, 2025 | With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for | |
| CVE-2025-22150 | Med | 6.8 | < 2021.06-4.module_el8.10.0+3958+472a6467 | 2021.06-4.module_el8.10.0+3958+472a6467 | Jan 21, 2025 | Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generat | |
| CVE-2024-36137 | Low | 3.3 | < 2021.06-4.module_el8.9.0+3775+d8460d35 | 2021.06-4.module_el8.9.0+3775+d8460d35 | Sep 7, 2024 | A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" fi | |
| CVE-2023-46809 | Hig | 7.4 | < 2021.06-4.module_el9.1.0+13+d9a595ea | 2021.06-4.module_el9.1.0+13+d9a595ea | Sep 7, 2024 | Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryp | |
| CVE-2023-39333 | Med | 5.3 | < 2021.06-4.module_el9.1.0+13+d9a595ea | 2021.06-4.module_el9.1.0+13+d9a595ea | Sep 7, 2024 | Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. | |
| CVE-2024-22018 | Low | 2.9 | < 2021.06-4.module_el8.9.0+3775+d8460d35 | 2021.06-4.module_el8.9.0+3775+d8460d35 | Jul 10, 2024 | A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious acto | |
| CVE-2024-22020 | Med | 6.5 | < 2021.06-4.module_el8.9.0+3775+d8460d35 | 2021.06-4.module_el8.9.0+3775+d8460d35 | Jul 9, 2024 | A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs i | |
| CVE-2024-27982 | Med | 6.5 | < 2021.06-4.module_el8.9.0+3684+11b9e959 | 2021.06-4.module_el8.9.0+3684+11b9e959 | May 7, 2024 | The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attacke | |
| CVE-2024-27983 | Hig | 8.2 | < 2021.06-4.module_el8.9.0+3684+11b9e959 | 2021.06-4.module_el8.9.0+3684+11b9e959 | Apr 9, 2024 | An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the se | |
| CVE-2024-28182 | Med | 5.3 | < 2021.06-4.module_el8.9.0+3684+11b9e959 | 2021.06-4.module_el8.9.0+3684+11b9e959 | Apr 4, 2024 | nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usag | |
| CVE-2024-28863 | Med | 6.5 | < 2021.06-4.module_el8.9.0+3775+d8460d35 | 2021.06-4.module_el8.9.0+3775+d8460d35 | Mar 21, 2024 | node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js cl | |
| CVE-2024-22025 | Med | 6.5 | < 2021.06-4.module_el8.9.0+3684+11b9e959 | 2021.06-4.module_el8.9.0+3684+11b9e959 | Mar 19, 2024 | A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always d | |
| CVE-2024-22017 | Hig | 7.3 | < 2021.06-4.module_el8.9.0+3684+11b9e959 | 2021.06-4.module_el8.9.0+3684+11b9e959 | Mar 19, 2024 | setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users us |
- affected < 2021.06-6.module_el8.10.0+4086+70facd4afixed 2021.06-6.module_el8.10.0+4086+70facd4a
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Ar
- affected < 2021.06-6.module_el8.10.0+4086+70facd4afixed 2021.06-6.module_el8.10.0+4086+70facd4a
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and
- affected < 2021.06-4.module_el8.10.0+3961+6a788e57fixed 2021.06-4.module_el8.10.0+3961+6a788e57
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
- affected < 2021.06-4.module_el9.5.0+139+09296491fixed 2021.06-4.module_el9.5.0+139+09296491
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentiall
- affected < 2021.06-4.module_el8.10.0+3961+6a788e57fixed 2021.06-4.module_el8.10.0+3961+6a788e57
An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of
- affected < 2021.06-4.module_el8.10.0+3961+6a788e57fixed 2021.06-4.module_el8.10.0+3961+6a788e57
c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queri
- affected < 2021.06-4.module_el8.10.0+3958+472a6467fixed 2021.06-4.module_el8.10.0+3958+472a6467
A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to inc
- affected < 2021.06-4.module_el8.10.0+3958+472a6467fixed 2021.06-4.module_el8.10.0+3958+472a6467
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for
- affected < 2021.06-4.module_el8.10.0+3958+472a6467fixed 2021.06-4.module_el8.10.0+3958+472a6467
Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generat
- affected < 2021.06-4.module_el8.9.0+3775+d8460d35fixed 2021.06-4.module_el8.9.0+3775+d8460d35
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" fi
- affected < 2021.06-4.module_el9.1.0+13+d9a595eafixed 2021.06-4.module_el9.1.0+13+d9a595ea
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryp
- affected < 2021.06-4.module_el9.1.0+13+d9a595eafixed 2021.06-4.module_el9.1.0+13+d9a595ea
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.
- affected < 2021.06-4.module_el8.9.0+3775+d8460d35fixed 2021.06-4.module_el8.9.0+3775+d8460d35
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious acto
- affected < 2021.06-4.module_el8.9.0+3775+d8460d35fixed 2021.06-4.module_el8.9.0+3775+d8460d35
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs i
- affected < 2021.06-4.module_el8.9.0+3684+11b9e959fixed 2021.06-4.module_el8.9.0+3684+11b9e959
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attacke
- affected < 2021.06-4.module_el8.9.0+3684+11b9e959fixed 2021.06-4.module_el8.9.0+3684+11b9e959
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the se
- affected < 2021.06-4.module_el8.9.0+3684+11b9e959fixed 2021.06-4.module_el8.9.0+3684+11b9e959
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usag
- affected < 2021.06-4.module_el8.9.0+3775+d8460d35fixed 2021.06-4.module_el8.9.0+3775+d8460d35
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js cl
- affected < 2021.06-4.module_el8.9.0+3684+11b9e959fixed 2021.06-4.module_el8.9.0+3684+11b9e959
A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always d
- affected < 2021.06-4.module_el8.9.0+3684+11b9e959fixed 2021.06-4.module_el8.9.0+3684+11b9e959
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users us
Page 3 of 5