Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-docs | Apr 4, 2024 | Mar 26, 2024 |
| Debian | — | Upgrade nodejs | Mar 28, 2024 | Mar 28, 2024 |
| Freebsd | — | Upgrade node21Upgrade nodeUpgrade node18Upgrade node16Upgrade node20 | Dec 10, 2025 | Mar 1, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Sep 7, 2024 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-docs | Apr 9, 2024 | Feb 16, 2024 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade npmUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-nodemonNo solution exists | Mar 27, 2024 | Feb 16, 2024 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-debugsource | Mar 28, 2024 | Mar 27, 2024 |
| Suse | — | Upgrade npm14Upgrade nodejs14Upgrade nodejs18-develUpgrade nodejs16-docsUpgrade nodejs14-develUpgrade npm12Upgrade corepack18Upgrade corepack20Upgrade nodejs12Upgrade nodejs20-docsUpgrade nodejs18-docsUpgrade nodejs20-develUpgrade npm20Upgrade nodejs20Upgrade npm16Upgrade nodejs16-develUpgrade nodejs12-docsUpgrade nodejs16Upgrade npm18Upgrade nodejs12-develUpgrade nodejs18Upgrade nodejs14-docs | Feb 29, 2024 | Feb 28, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 7, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 7, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub