Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

September 23rd 2022 Security Releases

Node.js released security updates for the 18.x, 16.x, and 14.x release lines addressing DNS rebinding, HTTP request smuggling, and other vulnerabilities.

Announced

Node.js · Fixed in Node.js v14.20.1 (LTS), Node.js v16.17.1 (LTS), Node.js v18.9.1 (Current)CVE-2022-32212CVE-2018-7160CVE-2022-32213CVE-2022-35256CVE-2022-32222CVE-2022-35255
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues.

Node.js

Node.js v14.20.1 (LTS)
Affected versions
All versions of the 18.x, 16.x, and 14.x release lines
Impacts: All versions of the 18.x, 16.x, and 14.x release lines.
Fixed versions
Node.js v14.20.1 (LTS)
Node.js v14.20.1 (LTS)
Node.js v16.17.1 (LTS)
Node.js v16.17.1 (LTS)
Node.js v18.9.1 (Current)
Node.js v18.9.1 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2022-32212
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
CVE-2018-7160
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices) (High) (CVE-2022-32212, CVE-2018-7160)
CVE-2022-32213
CVE-2022-32213 bypass via obs-fold mechanic (Medium) (CVE-2022-32213)
CVE-2022-35256
HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium) (CVE-2022-35256)
CVE-2022-32222
Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on macOS (Medium) (CVE-2022-32222)
CVE-2022-35255
Weak randomness in WebCrypto keygen (High) (CVE-2022-35255)

Publisher severity

No explicit severity was extracted.

Event
#31124 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 14.20.1 (LTS)

Node.js 14.20.1 fixes three listed CVEs, including DNS rebinding in --inspect on macOS and HTTP request smuggling.

Announced

Node.js · Fixed in 14.20.1CVE-2022-32212CVE-2022-32213CVE-2022-35256
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 14.20.1 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
14.20.1
Node.js 14.20.1 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2022-32212
CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
CVE-2022-32213
CVE-2022-32213: bypass via obs-fold mechanic (Medium)
CVE-2022-35256
CVE-2022-35256: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium)

Publisher severity

No explicit severity was extracted.

Event
#30913 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 18.9.1 (Current)

Node.js 18.9.1 fixes multiple security vulnerabilities, including DNS rebinding, OpenSSL configuration file handling, HTTP request smuggling, and weak randomness in WebCrypto key generation.

Announced

Node.js · Fixed in 18.9.1CVE-2022-32212CVE-2022-32222CVE-2022-32213CVE-2022-32215CVE-2022-35256CVE-2022-35255
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 18.9.1 (Current)
Affected versions
Not stated in this extraction
Fixed versions
18.9.1
Node.js 18.9.1 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2022-32212
CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
CVE-2022-32222
CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium)
CVE-2022-32213
CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)
CVE-2022-32215
CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)
CVE-2022-35256
CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
CVE-2022-35255
CVE-2022-35255: Weak randomness in WebCrypto keygen

Publisher severity

No explicit severity was extracted.

Event
#30896 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement