A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

An update of the nodejs package has been released.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:7205 advisory.

  - When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the     application can intercept the operation and return a forged checksum to the node's policy implementation,     thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the     experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time     this CVE was issued, the policy mechanism is an experimental feature of Node.js. (CVE-2023-38552)

  - A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The     new path traversal vulnerability arises because the implementation does not protect itself against the     application overwriting built-in utility functions with user-defined implementations. Please note that at     the time this CVE was issued, the permission model is an experimental feature of Node.js. (CVE-2023-39331)

  - Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js     environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through     strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer`     `Uint8Array` objects. This is distinct from CVE-2023-32004 which only referred to `Buffer` objects.
    However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`. Please note     that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
    (CVE-2023-39332)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already     cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design,     `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in     browser environments. Since undici handles headers more liberally than the spec, there was a disconnect     from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to     accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection     target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version     5.26.2. There are no known workarounds. (CVE-2023-45143)

  - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The     injected code may be able to access data and functions that the WebAssembly module itself does not have     access to, similar to as if the WebAssembly module was a JavaScript module. Impacts: Thanks to dittyroma     for reporting the issue and to Tobias Nieen for fixing it. (CVE-2023-39333)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7205 advisory.

    - Fixes CVE-2023-44487 (nghttp)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7205 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)

    * nodejs: permission model improperly protects against path traversal (CVE-2023-39331)

    * nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)

    * nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)

    * nodejs: code injection via WebAssembly export names (CVE-2023-39333)

    * node-undici: cookie leakage (CVE-2023-45143)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7b52921cae advisory.

    ## 2023-10-13, Version 20.8.1 (Current), @RafaelGSS

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487): `nghttp2` Security     Release (High)
    * [CVE-2023-45143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143): `undici` Security     Release (High)
    * [CVE-2023-39332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39332): Path traversal through     path stored in Uint8Array (High)
    * [CVE-2023-39331](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39331): Permission model     improperly protects against path traversal (High)
    * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks     according to policies can be circumvented (Medium)
    * [CVE-2023-39333](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39333): Code injection via     WebAssembly export names (Low)

    More detailed information on each of the vulnerabilities can be found in [October 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/) blog post.

    ----

    ## 2023-09-28, Version 20.8.0 (Current), @ruyadorno

    ### Notable Changes

    #### Stream performance improvements

    Performance improvements to writable and readable streams, improving the creation and destruction by 15%     and reducing the memory overhead each stream takes in Node.js

    Contributed by Benjamin Gruenbaum in [#49745](https://github.com/nodejs/node/pull/49745) and Raz Luvaton     in [#49834](https://github.com/nodejs/node/pull/49834).

    Performance improvements for readable webstream, improving readable stream async iterator consumption by     140% and improving readable stream `pipeTo` consumption by 60%

    Contributed by Raz Luvaton in [#49662](https://github.com/nodejs/node/pull/49662) and     [#49690](https://github.com/nodejs/node/pull/49690).

    #### Rework of memory management in `vm` APIs with the `importModuleDynamically` option

    This rework addressed a series of long-standing memory leaks and use-after-free issues in the following     APIs that support `importModuleDynamically`:

    * `vm.Script`
    * `vm.compileFunction`
    * `vm.SyntheticModule`
    * `vm.SourceTextModule`

    This should enable affected users (in particular Jest users) to upgrade from older versions of Node.js.

    Contributed by Joyee Cheung in [#48510](https://github.com/nodejs/node/pull/48510).

    #### Other notable changes

    * \[[`32d4d29d02`](https://github.com/nodejs/node/commit/32d4d29d02)] - **deps**: add     v8::Object::SetInternalFieldForNodeCore() (Joyee Cheung)     [#49874](https://github.com/nodejs/node/pull/49874)
    * \[[`0e686d096b`](https://github.com/nodejs/node/commit/0e686d096b)] - **doc**: deprecate `fs.F_OK`,     `fs.R_OK`, `fs.W_OK`, `fs.X_OK` (Livia Medeiros) [#49683](https://github.com/nodejs/node/pull/49683)
    * \[[`a5dd057540`](https://github.com/nodejs/node/commit/a5dd057540)] - **doc**: deprecate     `util.toUSVString` (Yagiz Nizipli) [#49725](https://github.com/nodejs/node/pull/49725)
    * \[[`7b6a73172f`](https://github.com/nodejs/node/commit/7b6a73172f)] - **doc**: deprecate calling     `promisify` on a function that returns a promise (Antoine du Hamel)     [#49647](https://github.com/nodejs/node/pull/49647)
    * \[[`1beefd5f16`](https://github.com/nodejs/node/commit/1beefd5f16)] - **esm**: set all hooks as release     candidate (Geoffrey Booth) [#49597](https://github.com/nodejs/node/pull/49597)
    * \[[`b0ce78a75b`](https://github.com/nodejs/node/commit/b0ce78a75b)] - **module**: fix the leak in     SourceTextModule and ContextifySript (Joyee Cheung) [#48510](https://github.com/nodejs/node/pull/48510)
    * \[[`4e578f8ab1`](https://github.com/nodejs/node/commit/4e578f8ab1)] - **module**: fix leak of     vm.SyntheticModule (Joyee Cheung) [#48510](https://github.com/nodejs/node/pull/48510)
    * \[[`69e4218772`](https://github.com/nodejs/node/commit/69e4218772)] - **module**: use symbol in WeakMap     to manage host defined options (Joyee Cheung) [#48510](https://github.com/nodejs/node/pull/48510)
    * \[[`14ece0aa76`](https://github.com/nodejs/node/commit/14ece0aa76)] - **(SEMVER-MINOR)** **src**: allow     embedders to override NODE\_MODULE\_VERSION (Cheng Zhao)     [#49279](https://github.com/nodejs/node/pull/49279)
    * \[[`9fd67fbff0`](https://github.com/nodejs/node/commit/9fd67fbff0)] - **stream**: use bitmap in writable     state (Raz Luvaton) [#49834](https://github.com/nodejs/node/pull/49834)
    * \[[`0ccd4638ac`](https://github.com/nodejs/node/commit/0ccd4638ac)] - **stream**: use bitmap in readable     state (Benjamin Gruenbaum) [#49745](https://github.com/nodejs/node/pull/49745)
    * \[[`7c5e322346`](https://github.com/nodejs/node/commit/7c5e322346)] - **stream**: improve webstream     readable async iterator performance (Raz Luvaton) [#49662](https://github.com/nodejs/node/pull/49662)
    * \[[`80b342cc38`](https://github.com/nodejs/node/commit/80b342cc38)] - **(SEMVER-MINOR)**
    **test\_runner**: accept `testOnly` in `run` (Moshe Atlow)     [#49753](https://github.com/nodejs/node/pull/49753)
    * \[[`17a05b141d`](https://github.com/nodejs/node/commit/17a05b141d)] - **(SEMVER-MINOR)**
    **test\_runner**: add junit reporter (Moshe Atlow) [#49614](https://github.com/nodejs/node/pull/49614)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-4d2fd884ea advisory.

    ## 2023-10-13, Version 20.8.1 (Current), @RafaelGSS

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487): `nghttp2` Security     Release (High)
    * [CVE-2023-45143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143): `undici` Security     Release (High)
    * [CVE-2023-39332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39332): Path traversal through     path stored in Uint8Array (High)
    * [CVE-2023-39331](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39331): Permission model     improperly protects against path traversal (High)
    * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks     according to policies can be circumvented (Medium)
    * [CVE-2023-39333](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39333): Code injection via     WebAssembly export names (Low)

    More detailed information on each of the vulnerabilities can be found in [October 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/) blog post.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-f66fc0f62a advisory.

    ## 2023-10-13, Version 20.8.1 (Current), @RafaelGSS

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * [CVE-2023-44487](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487): `nghttp2` Security     Release (High)
    * [CVE-2023-45143](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143): `undici` Security     Release (High)
    * [CVE-2023-39332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39332): Path traversal through     path stored in Uint8Array (High)
    * [CVE-2023-39331](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39331): Permission model     improperly protects against path traversal (High)
    * [CVE-2023-38552](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552):  Integrity checks     according to policies can be circumvented (Medium)
    * [CVE-2023-39333](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39333): Code injection via     WebAssembly export names (Low)

    More detailed information on each of the vulnerabilities can be found in [October 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/) blog post.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 18.18.2, 20.8.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Friday October 13 2023 Security Releases advisory.

  - Undici did not always clear Cookie headers on cross-origin redirects. By design, cookie headers are     forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments.
    Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the     spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to     a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector)     to leak the cookie to the 3rd party site. More details area available in GHSA-wqq4-5wpv-mx2g     (CVE-2023-45143)

  - Rapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound     causes denial of service. See https://www.cve.org/CVERecord?id=CVE-2023-44487 for details. Impacts:
    (CVE-2023-44487)

  - A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently. The new path traversal     vulnerability arises because the implementation does not protect itself against the application     overwriting built-in utility functions with user-defined implementations. Impacts: Please note that at the     time this CVE is issued, the permission model is an experimental feature of Node.js. Thanks to Tobias     Nieen who reported and created the security patch. (CVE-2023-39331)

  - Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js     environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through     strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer     Uint8Array objects. This is distinct from CVE-2023-32004 (report 2038134), which only referred to Buffer     objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer. Impacts:
    Please note that at the time this CVE is issued, the permission model is an experimental feature of     Node.js. Thanks to Tobias Nieen who reported and created the security patch. (CVE-2023-39332)

  - When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the     application can intercept the operation and return a forged checksum to node's policy implementation, thus     effectively disabling the integrity check. Impacts: Please note that at the time this CVE is issued, the     policy mechanism is an experimental feature of Node.js. Thanks to Tobias Nieen who reported and created     the security patch. (CVE-2023-38552)

  - Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The     injected code may be able to access data and functions that the WebAssembly module itself does not have     access to, similar to as if the WebAssembly module was a JavaScript module. Impacts: Thanks to dittyroma     for reporting the issue and to Tobias Nieen for fixing it. (CVE-2023-39333)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204149	Photon OS 5.0: Nodejs PHSA-2023-5.0-0132	Nessus	PhotonOS Local Security Checks	critical
186401	Rocky Linux 8 : nodejs:20 (RLSA-2023:7205)	Nessus	Rocky Linux Local Security Checks	critical
186197	Oracle Linux 8 : nodejs:20 (ELSA-2023-7205)	Nessus	Oracle Linux Local Security Checks	critical
185689	RHEL 8 : nodejs:20 (RHSA-2023:7205)	Nessus	Red Hat Local Security Checks	critical
185303	Fedora 39 : nodejs20 (2023-7b52921cae)	Nessus	Fedora Local Security Checks	critical
183909	Fedora 38 : nodejs20 (2023-4d2fd884ea)	Nessus	Fedora Local Security Checks	critical
183908	Fedora 37 : nodejs20 (2023-f66fc0f62a)	Nessus	Fedora Local Security Checks	critical
183390	Node.js 18.x < 18.18.2 / 20.x < 20.8.1 Multiple Vulnerabilities (Friday October 13 2023 Security Releases).	Nessus	Misc.	critical

Detections

Analytics

CVE-2023-39331

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical