opensuse/nodejs16&distro=openSUSE Leap 15.4

Vulnerabilities (29)

• CVE-2022-35255Dec 5, 2022
  affected < 16.17.1-150400.3.9.1fixed 16.17.1-150400.3.9.1

  A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() alwa

• CVE-2022-35948Aug 13, 2022
  affected < 16.17.0-150400.3.6.1fixed 16.17.0-150400.3.6.1

  undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici'

• CVE-2022-35949Aug 12, 2022
  affected < 16.17.0-150400.3.6.1fixed 16.17.0-150400.3.6.1

  undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//

• CVE-2022-31150Jul 19, 2022
  affected < 16.17.0-150400.3.6.1fixed 16.17.0-150400.3.6.1

  undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a wor

• CVE-2022-32215Jul 14, 2022
  affected < 16.16.0-150400.3.3.2fixed 16.16.0-150400.3.3.2

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

• CVE-2022-32214Jul 14, 2022
  affected < 16.16.0-150400.3.3.2fixed 16.16.0-150400.3.3.2

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

• CVE-2022-32213Jul 14, 2022
  affected < 16.16.0-150400.3.3.2fixed 16.16.0-150400.3.3.2

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

• CVE-2022-32212Jul 14, 2022
  affected < 16.16.0-150400.3.3.2fixed 16.16.0-150400.3.3.2

  A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding

• CVE-2022-29244Jun 13, 2022
  affected < 16.17.0-150400.3.6.1fixed 16.17.0-150400.3.6.1

  npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, m