Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

Node.js 18.19.1 (LTS)

Node.js 18.19.1 is a security release addressing several vulnerabilities, including code injection and privilege escalation, denial of service, and a timing attack. The release explicitly rates some issues High and others Medium.

Announced

Node.js · Fixed in 18.19.1CVE-2024-21892CVE-2024-22019CVE-2023-46809CVE-2024-22025
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 18.19.1 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
18.19.1
Version 18.19.1 'Hydrogen' (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2024-21892
CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
CVE-2024-22019
CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
CVE-2023-46809
CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
CVE-2024-22025
CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)

Publisher severity

No explicit severity was extracted.

Event
#24996 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 21.6.2 (Current)

Node.js 21.6.2 is a security release addressing multiple vulnerabilities, including code injection, denial of service, path traversal, privilege escalation, and permission model bypasses.

Announced

Node.js · Fixed in 21.6.2CVE-2024-21892CVE-2024-22019CVE-2024-21896CVE-2024-22017CVE-2023-46809CVE-2024-21891CVE-2024-21890CVE-2024-22025
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 21.6.2 (Current)
Affected versions
Not stated in this extraction
Fixed versions
21.6.2
Version 21.6.2 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2024-21892
CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
CVE-2024-22019
CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
CVE-2024-21896
CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
CVE-2024-22017
CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
CVE-2023-46809
CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
CVE-2024-21891
CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
CVE-2024-21890
CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
CVE-2024-22025
CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)

Publisher severity

No explicit severity was extracted.

Event
#24995 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 20.11.1 (LTS)

Node.js 20.11.1 is a security release that addresses multiple security issues, including code injection, privilege escalation, denial of service, and permission model bypasses.

Announced

Node.js · Fixed in 20.11.1CVE-2024-21892CVE-2024-22019CVE-2024-21896CVE-2024-22017CVE-2023-46809CVE-2024-21891CVE-2024-21890CVE-2024-22025
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release.

Node.js

Node.js 20.11.1 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
20.11.1
Version 20.11.1 'Iron' (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2024-21892
CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities
CVE-2024-22019
CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks
CVE-2024-21896
CVE-2024-21896 - Path traversal by monkey-patching Buffer internals
CVE-2024-22017
CVE-2024-22017 - setuid() does not drop all privileges due to io_uring
CVE-2023-46809
CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack
CVE-2024-21891
CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization
CVE-2024-21890
CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write
CVE-2024-22025
CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding

Publisher severity

No explicit severity was extracted.

Event
#24814 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement