The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejsUpgrade npmUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemon | Oct 20, 2022 | Oct 18, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Dec 5, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejsUpgrade nodejs-debuginfoUpgrade npmUpgrade v8-develUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-devel | Feb 17, 2025 | Sep 23, 2022 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade npmUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundler | Oct 20, 2022 | Oct 17, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Dec 5, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Dec 5, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-17-fastrUpgrade nodejs-full-i18nUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-17-pythonUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade graalvm22-ce-11Upgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-11-develUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-11-native-imageUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade graalvm22-ce-17-wasmUpgrade npmUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-11-python-develUpgrade nodejs-nodemonUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-17-ruby-develUpgrade nodejs-docsUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-11-ruby | Oct 18, 2022 | Sep 23, 2022 |
| Redhat_linux | — | Upgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade npm | Oct 20, 2022 | Oct 17, 2022 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejs-full-i18n | Mar 12, 2024 | Dec 5, 2022 |
| Suse | — | Upgrade nodejs16Upgrade nodejs16-develUpgrade nodejs18-develUpgrade corepack16Upgrade nodejs16-docsUpgrade npm18Upgrade npm16Upgrade nodejs18-docsUpgrade corepack18Upgrade nodejs18 | Oct 26, 2022 | Oct 5, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Dec 5, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub