Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade npm | Apr 4, 2024 | Mar 26, 2024 |
| Debian | — | Upgrade nodejs | Mar 28, 2024 | Mar 28, 2024 |
| Freebsd | — | Upgrade node20Upgrade node16Upgrade node18Upgrade nodeUpgrade node21 | Dec 10, 2025 | Mar 1, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Sep 7, 2024 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs | Apr 9, 2024 | Feb 16, 2024 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debuginfoNo solution existsUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs | Mar 27, 2024 | Feb 16, 2024 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-debugsource | Mar 28, 2024 | Mar 27, 2024 |
| Suse | — | Upgrade npm18Upgrade nodejs16Upgrade nodejs18Upgrade nodejs12-develUpgrade nodejs14-docsUpgrade npm12Upgrade nodejs18-docsUpgrade nodejs20-docsUpgrade nodejs16-develUpgrade nodejs12-docsUpgrade npm14Upgrade nodejs20-develUpgrade corepack18Upgrade nodejs20Upgrade nodejs18-develUpgrade npm16Upgrade nodejs16-docsUpgrade nodejs14Upgrade corepack20Upgrade nodejs12Upgrade npm20Upgrade nodejs14-devel | Feb 29, 2024 | Feb 28, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 7, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 7, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub