Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-nodejsalma-upgrade-nodejs-develalma-upgrade-nodejs-docsalma-upgrade-nodejs-full-i18nalma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packagingalma-upgrade-nodejs-packaging-bundleralma-upgrade-npm | Apr 4, 2024 | Mar 26, 2024 | |
| Debian | debian-upgrade-nodejs | Mar 28, 2024 | Mar 28, 2024 | |
| Freebsd | freebsd-upgrade-package-nodefreebsd-upgrade-package-node16freebsd-upgrade-package-node18freebsd-upgrade-package-node20freebsd-upgrade-package-node21 | Dec 10, 2025 | Mar 1, 2024 | |
| Gentoo Linux | gentoo-linux-upgrade-net-libs-nodejs | May 15, 2025 | Sep 7, 2024 | |
| Oracle_linux | — | oracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-nodejs-packaging-bundleroracle-linux-upgrade-npm | Apr 9, 2024 | Feb 16, 2024 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-nodejs-packaging-bundlerredhat-upgrade-npm | Mar 27, 2024 | Feb 16, 2024 | |
| Rocky_linux | rocky-upgrade-nodejsrocky-upgrade-nodejs-debuginforocky-upgrade-nodejs-debugsourcerocky-upgrade-nodejs-develrocky-upgrade-nodejs-full-i18nrocky-upgrade-npm | Mar 28, 2024 | Mar 27, 2024 | |
| Suse | — | suse-upgrade-corepack18suse-upgrade-corepack20suse-upgrade-nodejs12suse-upgrade-nodejs12-develsuse-upgrade-nodejs12-docssuse-upgrade-nodejs14suse-upgrade-nodejs14-develsuse-upgrade-nodejs14-docssuse-upgrade-nodejs16suse-upgrade-nodejs16-develsuse-upgrade-nodejs16-docssuse-upgrade-nodejs18suse-upgrade-nodejs18-develsuse-upgrade-nodejs18-docssuse-upgrade-nodejs20suse-upgrade-nodejs20-develsuse-upgrade-nodejs20-docssuse-upgrade-npm12suse-upgrade-npm14suse-upgrade-npm16suse-upgrade-npm18suse-upgrade-npm20 | Feb 29, 2024 | Feb 28, 2024 |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | Sep 7, 2024 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Sep 7, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub