When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs | Aug 3, 2023 | Jul 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade v8-develUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debugsource | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade npm | Aug 1, 2023 | Jul 31, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Nov 28, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Nov 28, 2023 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade graalvm-community-17-rubyUpgrade graalvm-community-17-jdkUpgrade nodejs-docsUpgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-libpolyglotUpgrade graalvm-community-21-native-imageUpgrade graalvm-community-17-llvm-toolchainUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-polyglotUpgrade graalvm-community-17-regexUpgrade graalvm-community-17-native-image-llvm-backendUpgrade nodejs-packagingUpgrade graalvm-community-17-llvmUpgrade nodejs-packaging-bundlerUpgrade graalvm-community-17-ruby-develUpgrade nodejs-libsUpgrade graalvm-community-17-python-develUpgrade graalvm-community-17-nodejsUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-17-espressoUpgrade npmUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-nodejs-develUpgrade graalvm-community-17-toolsUpgrade nodejs-develUpgrade graalvm-community-21-jdkUpgrade nodejs-nodemonUpgrade graalvm-community-17-wasmUpgrade graalvm-community-17-javascript | May 21, 2024 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade npmNo solution existsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-full-i18n | Aug 1, 2023 | Jul 31, 2023 |
| Rocky_linux | — | Upgrade nodejsUpgrade npmUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-debuginfo | Mar 5, 2024 | Nov 28, 2023 |
| Suse | — | Upgrade nodejs18-docsUpgrade nodejs16-develUpgrade nodejs18-develUpgrade corepack18Upgrade nodejs18Upgrade corepack16Upgrade npm16Upgrade npm18Upgrade nodejs16-docs | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade libnode72Upgrade nodejs (Ubuntu Pro)Upgrade libnode64Upgrade nodejs-docUpgrade nodejsUpgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode108Upgrade nodejs-doc (Ubuntu Pro)Upgrade libnode-dev | Apr 17, 2024 | Nov 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub