When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-nodejsalma-upgrade-nodejs-develalma-upgrade-nodejs-docsalma-upgrade-nodejs-full-i18nalma-upgrade-nodejs-libsalma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packagingalma-upgrade-nodejs-packaging-bundleralma-upgrade-npm | Aug 3, 2023 | Jul 31, 2023 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-nodejsamazon-linux-2023-upgrade-nodejs-debuginfoamazon-linux-2023-upgrade-nodejs-debugsourceamazon-linux-2023-upgrade-nodejs-develamazon-linux-2023-upgrade-nodejs-docsamazon-linux-2023-upgrade-nodejs-full-i18namazon-linux-2023-upgrade-nodejs-libsamazon-linux-2023-upgrade-nodejs-libs-debuginfoamazon-linux-2023-upgrade-npmamazon-linux-2023-upgrade-v8-devel | Feb 17, 2025 | Jun 20, 2023 | |
| Centos_linux | — | centos-upgrade-nodejscentos-upgrade-nodejs-debuginfocentos-upgrade-nodejs-debugsourcecentos-upgrade-nodejs-develcentos-upgrade-nodejs-docscentos-upgrade-nodejs-full-i18ncentos-upgrade-nodejs-libscentos-upgrade-nodejs-libs-debuginfocentos-upgrade-nodejs-nodemoncentos-upgrade-nodejs-packagingcentos-upgrade-nodejs-packaging-bundlercentos-upgrade-npm | Aug 1, 2023 | Jul 31, 2023 |
| Debian | debian-upgrade-nodejs | Jan 3, 2024 | Nov 28, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-net-libs-nodejs | May 10, 2024 | Nov 28, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-graalvm-community-17-espressooracle-linux-upgrade-graalvm-community-17-espresso-llvmoracle-linux-upgrade-graalvm-community-17-icu4joracle-linux-upgrade-graalvm-community-17-javascriptoracle-linux-upgrade-graalvm-community-17-jdkoracle-linux-upgrade-graalvm-community-17-libpolyglotoracle-linux-upgrade-graalvm-community-17-llvmoracle-linux-upgrade-graalvm-community-17-llvm-toolchainoracle-linux-upgrade-graalvm-community-17-native-imageoracle-linux-upgrade-graalvm-community-17-native-image-llvm-backendoracle-linux-upgrade-graalvm-community-17-nodejsoracle-linux-upgrade-graalvm-community-17-nodejs-develoracle-linux-upgrade-graalvm-community-17-polyglotoracle-linux-upgrade-graalvm-community-17-pythonoracle-linux-upgrade-graalvm-community-17-python-develoracle-linux-upgrade-graalvm-community-17-regexoracle-linux-upgrade-graalvm-community-17-rubyoracle-linux-upgrade-graalvm-community-17-ruby-develoracle-linux-upgrade-graalvm-community-17-toolsoracle-linux-upgrade-graalvm-community-17-wasmoracle-linux-upgrade-graalvm-community-21-jdkoracle-linux-upgrade-graalvm-community-21-native-imageoracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-libsoracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-nodejs-packaging-bundleroracle-linux-upgrade-npm | May 21, 2024 | Jun 20, 2023 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-libsredhat-upgrade-nodejs-libs-debuginforedhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-nodejs-packaging-bundlerredhat-upgrade-npm | Aug 1, 2023 | Jul 31, 2023 | |
| Rocky_linux | rocky-upgrade-nodejsrocky-upgrade-nodejs-debuginforocky-upgrade-nodejs-debugsourcerocky-upgrade-nodejs-develrocky-upgrade-nodejs-full-i18nrocky-upgrade-npm | Mar 5, 2024 | Nov 28, 2023 | |
| Suse | — | suse-upgrade-corepack16suse-upgrade-corepack18suse-upgrade-nodejs16suse-upgrade-nodejs16-develsuse-upgrade-nodejs16-docssuse-upgrade-nodejs18suse-upgrade-nodejs18-develsuse-upgrade-nodejs18-docssuse-upgrade-npm16suse-upgrade-npm18 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | ubuntu-pro-upgrade-nodejsubuntu-pro-upgrade-nodejs-devubuntu-pro-upgrade-nodejs-docubuntu-pro-upgrade-nodejs-legacyubuntu-upgrade-libnode-devubuntu-upgrade-libnode108ubuntu-upgrade-libnode64ubuntu-upgrade-libnode72ubuntu-upgrade-nodejsubuntu-upgrade-nodejs-doc | Apr 17, 2024 | Nov 28, 2023 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Nov 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub