When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs | Aug 3, 2023 | Jul 31, 2023 |
| Amazon_linux_2023 | — | Upgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade v8-develUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-devel | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs | Aug 1, 2023 | Jul 31, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Nov 28, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Nov 28, 2023 |
| Oracle_linux | — | Upgrade nodejs-packaging-bundlerUpgrade graalvm-community-17-libpolyglotUpgrade nodejs-libsUpgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-jdkUpgrade nodejs-docsUpgrade graalvm-community-21-native-imageUpgrade graalvm-community-17-regexUpgrade graalvm-community-17-ruby-develUpgrade graalvm-community-17-polyglotUpgrade graalvm-community-17-llvm-toolchainUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-native-image-llvm-backendUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-full-i18nUpgrade graalvm-community-17-rubyUpgrade graalvm-community-17-llvmUpgrade graalvm-community-17-python-develUpgrade npmUpgrade graalvm-community-17-nodejs-develUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-nodejsUpgrade nodejs-nodemonUpgrade graalvm-community-21-jdkUpgrade nodejs-develUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-wasmUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-tools | May 21, 2024 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonNo solution existsUpgrade npmUpgrade nodejs-packaging | Aug 1, 2023 | Jul 31, 2023 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-devel | Mar 5, 2024 | Nov 28, 2023 |
| Suse | — | Upgrade npm16Upgrade npm18Upgrade corepack16Upgrade nodejs16-docsUpgrade nodejs18-develUpgrade nodejs18Upgrade nodejs18-docsUpgrade corepack18Upgrade nodejs16Upgrade nodejs16-devel | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade libnode108Upgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode72Upgrade nodejsUpgrade nodejs-docUpgrade nodejs (Ubuntu Pro)Upgrade libnode64Upgrade nodejs-legacy (Ubuntu Pro) | Apr 17, 2024 | Nov 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub