RHSA-2023:1583: Moderate: nodejs:18 security, bug fix, and enhancement update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (18.14.2).Security Fix(es): glob-parent: Regular Expression Denial of Service (CVE-2021-35065) http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881) Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918) Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936) Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920) Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:1583?
The severity of RHSA-2023:1583 has been classified as a moderate security vulnerability.
How do I fix RHSA-2023:1583?
To fix RHSA-2023:1583, upgrade the Node.js packages to version 18.14.2-2.module+el8.7.0+18445+9493b6ea or later.
What packages are affected by RHSA-2023:1583?
The affected packages include nodejs, nodejs-nodemon, nodejs-packaging, npm, and their related variants.
What version of Node.js contains the security fix for RHSA-2023:1583?
The security fix for RHSA-2023:1583 is included in Node.js version 18.14.2.
Is RHSA-2023:1583 related to any specific vulnerability types?
Yes, RHSA-2023:1583 addresses vulnerabilities related to the glob-parent package's regular expression issues.