Node.js reports :

Updates are now available for all active Node.js release lines. In addition to fixes for security flaws in Node.js, they also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2r which contains a fix for a moderate severity security vulnerability.

For these releases, we have decided to withhold the fix for the Misinterpretation of Input (CWE-115) flaw mentioned in the original announcement. This flaw is very low severity and we are not satisfied that we had a complete and stable fix ready for release. We will be seeking to address this flaw via alternate mechanisms in the near future. In addition, we have introduced an additional CVE for a change in Node.js 6 that we have decided to classify as a Denial of Service (CWE-400) flaw.

We recommend that all Node.js users upgrade to a version listed below as soon as possible. OpenSSL: 0-byte record padding oracle (CVE-2019-1559) OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only. Node.js 10 and 11 are not impacted by this vulnerability as they use newer versions of OpenSSL which do not contain the flaw.

Under certain circumstances, a TLS server can be forced to respond differently to a client if a zero-byte record is received with an invalid padding compared to a zero-byte record with an invalid MAC.
This can be used as the basis of a padding oracle attack to decrypt data.

Only TLS connections using certain ciphersuites executing under certain conditions are exploitable. We are currently unable to determine whether the use of OpenSSL in Node.js exposes this vulnerability. We are taking a cautionary approach and recommend the same for users. For more information, see the advisory and a detailed write-up by the reporters of the vulnerability.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2925 advisory.

  - nodejs: Insufficient Slowloris fix causing DoS via server.headersTimeout bypass (CVE-2019-5737)

  - HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

  - HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  - HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

  - HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

  - HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

  - HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

  - HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

  - HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2019_2925 advisory.

    * HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

    * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

    * HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

    * HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

    * HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

    * HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

    * HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

    * HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-48 (Node.js: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Node.js. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly write arbitrary files, cause a Denial       of Service condition or can conduct HTTP request splitting attacks.
  Workaround :

    There is no known workaround at this time.

An update of the nodejs package has been released.

This update for nodejs4 fixes the following issues :

Security issues fixed :

CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127533).

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs6 to version 6.17.0 fixes the following issues :

Security issues fixed :

CVE-2019-5739: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127533).

CVE-2019-5737: Fixed a potentially attack vector which could lead to Denial of Service when HTTP connection are kept active (bsc#1127532).

CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080).

Release Notes: https://nodejs.org/en/blog/release/v6.17.0/

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2925 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.16.3).

    Security Fix(es):

    * HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

    * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

    * HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

    * HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

    * HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

    * HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

    * HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

    * HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2939 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.16.3).

    Security Fix(es):

    * HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

    * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

    * HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

    * HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

    * HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

    * HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

    * HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

    * HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs10 to version 10.1.2 fixes the following issue:
&#9; Security issue fixed :

  - CVE-2019-5737: Fixed a potentially attack vector which     could lead to Denial of Service when HTTP connection are     kept active (bsc#1127532).

This update was imported from the SUSE:SLE-12:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1,     an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive     mode and by sending headers very slowly. This keeps the connection and associated resources alive for a     long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer.
    This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js     release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before     11.10.1. (CVE-2019-5737)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4796-1 advisory.

    Alexander Minozhenko and James Bunton discovered that Node.js did not properly handle wildcards in name     fields of X.509 TLS certificates. An attacker could use this vulnerability to execute a machine-in-the-     middle- attack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)

    It was discovered that Node.js incorrectly handled certain NAPTR responses. A remote attacker could     possibly use this issue to cause applications using Node.js to crash, resulting in a denial of service.
    This issue only affected Ubuntu 16.04 ESM. (CVE-2017-1000381)

    Nikita Skovoroda discovered that Node.js mishandled certain input, leading to an out of bounds write. An     attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary     code. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12115)

    Arkadiy Tetelman discovered that Node.js improperly handled certain malformed HTTP requests. An attacker     could use this vulnerability to inject unexpected HTTP requests. This issue only affected Ubuntu 18.04     ESM. (CVE-2018-12116)

    Jan Maybach discovered that Node.js did not time out if incomplete HTTP/HTTPS headers were received. An     attacker could use this vulnerability to cause a denial of service by keeping HTTP/HTTPS connections alive     for a long period of time. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12122)

    Martin Bajanik discovered that the url.parse() method would return incorrect results if it received     specially crafted input. An attacker could use this vulnerability to spoof the hostname and bypass     hostname-specific security controls. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12123)

    It was discovered that Node.js is vulnerable to a DNS rebinding attack which could be exploited to perform     remote code execution. An attack is possible from malicious websites open in a web browser with network     access to the system running the Node.js process. This issue only affected Ubuntu 18.04 ESM.
    (CVE-2018-7160)

    It was discovered that the Buffer.fill() and Buffer.alloc() methods improperly handled certain inputs. An     attacker could use this vulnerability to cause a denial of service. This issue only affected Ubuntu 18.04     ESM. (CVE-2018-7167)

    Marco Pracucci discovered that Node.js mishandled HTTP and HTTPS connections. An attacker could use this     vulnerability to cause a denial of service. This issue only affected Ubuntu 18.04 ESM. (CVE-2019-5737)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:2925 advisory.

  - In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before 11.10.1,     an attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive     mode and by sending headers very slowly. This keeps the connection and associated resources alive for a     long period of time. Potential attacks are mitigated by the use of a load balancer or other proxy layer.
    This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active Node.js     release lines including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before     11.10.1. (CVE-2019-5737)

  - Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization     manipulation, potentially leading to a denial of service. The attacker requests a large amount of data     from a specified resource over multiple streams. They manipulate window size and stream priority to force     the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can     consume excess CPU, memory, or both. (CVE-2019-9511)

  - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of     responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
    (CVE-2019-9512)

  - Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
    The attacker creates multiple request streams and continually shuffles the priority of the streams in a     way that causes substantial churn to the priority tree. This can consume excess CPU. (CVE-2019-9513)

  - Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both. (CVE-2019-9514)

  - Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of     service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer     reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in     behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory,     or both. (CVE-2019-9515)

  - Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
    The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally     Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and     keep the allocation alive until the session dies. This can consume excess memory. (CVE-2019-9516)

  - Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to     a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint;
    however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the     wire. The attacker then sends a stream of requests for a large response object. Depending on how the     servers queue the responses, this can consume excess memory, CPU, or both. (CVE-2019-9517)

  - Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of     service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag.
    These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each     frame disproportionate to attack bandwidth. This can consume excess CPU. (CVE-2019-9518)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
122571	FreeBSD : Node.js -- multiple vulnerabilities (b71d7193-3c54-11e9-a3f9-00155d006b02)	Nessus	FreeBSD Local Security Checks	2019/3/4	2022/12/6	medium
145589	CentOS 8 : nodejs:10 (CESA-2019:2925)	Nessus	CentOS Local Security Checks	2021/1/29	2023/2/8	high
353692	Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2019_2925)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
134776	GLSA-202003-48 : Node.js: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/3/23	2024/3/21	critical
132525	Photon OS 1.0: Nodejs PHSA-2019-1.0-0257	Nessus	PhotonOS Local Security Checks	2019/12/31	2020/1/2	high
122999	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2019:0658-1)	Nessus	SuSE Local Security Checks	2019/3/21	2022/12/5	medium
123551	SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2019:0818-1)	Nessus	SuSE Local Security Checks	2019/4/1	2022/12/5	medium
129480	RHEL 8 : nodejs:10 (RHSA-2019:2925)	Nessus	Red Hat Local Security Checks	2019/10/1	2025/3/15	high
194000	RHEL 7 : rh-nodejs10-nodejs (RHSA-2019:2939)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/11/6	medium
124104	openSUSE Security Update : nodejs10 (openSUSE-2019-1211)	Nessus	SuSE Local Security Checks	2019/4/17	2024/6/3	high
253266	Linux Distros Unpatched Vulnerability : CVE-2019-5737	Nessus	Misc.	2025/8/21	2026/8/8	high
183156	Ubuntu 16.04 ESM / 18.04 ESM : Node.js vulnerabilities (USN-4796-1)	Nessus	Ubuntu Local Security Checks	2023/10/16	2025/9/3	high
184969	Rocky Linux 8 : nodejs:10 (RLSA-2019:2925)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/12/20	high

偵測

搜尋 Plugin

medium

high

high

critical

high

medium

medium

high

medium

high

high

high

high