Skip to content
Heist/ feed
UnratedFix available

Node.js 18.9.1 (Current)

Type: patchSource: Node.js announcements1 source record

Node.js 18.9.1 fixes multiple security vulnerabilities, including DNS rebinding, OpenSSL configuration file handling, HTTP request smuggling, and weak randomness in WebCrypto key generation.

Announced Source revision 1
Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 18.9.1 (Current)
Affected versions
Not stated in this extraction
Fixed versions
18.9.1
Node.js 18.9.1 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2022-32212
CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
CVE-2022-32222
CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium)
CVE-2022-32213
CVE-2022-32213: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)
CVE-2022-32215
CVE-2022-32215: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)
CVE-2022-35256
CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
CVE-2022-35255
CVE-2022-35255: Weak randomness in WebCrypto keygen

Publisher severity

No explicit severity was extracted.

Event
#30896 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement