UnratedFix available
Node.js 20.11.1 (LTS)
Node.js 20.11.1 is a security release that addresses multiple security issues, including code injection, privilege escalation, denial of service, and permission model bypasses.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
This is a security release.
Node.js
Node.js 20.11.1 (LTS)
- Affected versions
- Not stated in this extraction
- Fixed versions
- 20.11.1
Version 20.11.1 'Iron' (LTS)
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2024-21892
CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities
CVE-2024-22019CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks
CVE-2024-21896CVE-2024-21896 - Path traversal by monkey-patching Buffer internals
CVE-2024-22017CVE-2024-22017 - setuid() does not drop all privileges due to io_uring
CVE-2023-46809CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack
CVE-2024-21891CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization
CVE-2024-21890CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write
CVE-2024-22025CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding
Publisher severity
No explicit severity was extracted.
- Event
- #24814 · Revision 1
- Added to Heist Feed
- Publisher date