A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-devel | Apr 21, 2023 | Feb 23, 2023 |
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Feb 23, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade v8-develUpgrade nodejs-libsUpgrade npmUpgrade nodejs-full-i18n | Feb 17, 2025 | Feb 16, 2023 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-devel | Apr 10, 2023 | Feb 23, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Feb 23, 2023 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade npmUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-full-i18n | Apr 10, 2023 | Feb 23, 2023 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-full-i18n | Mar 12, 2024 | Feb 23, 2023 |
| Suse | — | Upgrade nodejs18Upgrade corepack16Upgrade nodejs18-docsUpgrade nodejs18-develUpgrade nodejs16-develUpgrade nodejs16Upgrade npm18Upgrade npm16Upgrade nodejs16-docsUpgrade corepack18 | Mar 6, 2023 | Feb 23, 2023 |
| Ubuntu | — | Upgrade libnode64Upgrade libnode108Upgrade libnode72Upgrade nodejs | Mar 5, 2024 | Feb 23, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 23, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub