Node.js fixes multiple bugs that could lead to RCE, HTTP request smuggling (2024)

Jessica Haworth08 July 2022 at 13:21 UTC
Updated: 05 September 2022 at 09:50 UTC

All security issues have been patched – update now

Node.js fixes multiple bugs that could lead to RCE, HTTP request smuggling (1)

Node.js maintainers have released multiple fixes for vulnerabilities in the JavaScript runtime environment that could lead to arbitrary code execution and HTTP request smuggling, among other attacks.

In an advisory released last night (July 7), the details of seven now-patched bugs were released, including three separate HTTP Request Smuggling vulnerabilities.

Read more of the latest news about security vulnerabilities

These three vulnerabilities – a flawed parsing of transfer-encoding bug, tracked as CVE-2022-32213; an improper delimiting of header fields issue, tracked as CVE-2022-32214; and an Incorrect parsing of multi-line transfer-encoding bug, tracked as CVE-2022-32215 – could all lead to HTTP request smuggling.

These bugs, which were all rated as medium severity, impact all versions of the 18.x, 16.x, and 14.x releases lines. llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js.

Other issues

The advisory also contains details of a DNS rebinding vulnerability in --inspect via invalid IP addresses.

Rated as high severity, the bug (CVE-2022-32212) could allow for arbitrary code execution, the advisory warns.

“The IsAllowedHost check can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid or not.

“When an invalid IPv4 address is provided browsers will make DNS requests to the DNS server, providing a vector for an attacker-controlled DNS server or a MitM who can spoof DNS responses to perform a rebinding attack and hence connect to the WebSocket debugger, allowing for arbitrary code execution. This is a bypass of CVE-2021-22884,” the post reads. The vulnerability impacts all versions of the 18.x, 16.x, and 14.x releases lines.

The advisory also details a DLL Hijacking vulnerability on Windows (CVE-2022-32223), and CVE-2022-32222, a medium-severity bug that could allow an attacker to attempt to read openssl.cnf from /home/iojs/build/ upon system startup.

BACKGROUND High severity OpenSSL bug could lead to remote code execution

Finally, the release also contains fixes for a vulnerability in OpenSSL, as previously reported by The Daily Swig.

The moderate-severity implementation bug (CVE-2022-2097) could cause encryption to fail in some circ*mstances.

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data, which could reveal sixteen bytes of data that was pre-existing in the memory that wasn’t written.

In the special case of ‘in place’ encryption, sixteen bytes of the plaintext could be revealed.

Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected.

All of the vulnerabilities have been fixed in the latest versions, Node.js v14.20.0 (LTS), Node.js v16.16.0 (LTS), and Node.js v18.5.0 (Current).

YOU MAY ALSO LIKE Spring Data MongoDB hit by another critical SpEL injection flaw

Node.js fixes multiple bugs that could lead to RCE, HTTP request smuggling (2024)

FAQs

What are the multiple vulnerabilities in node JS? ›

Multiple vulnerabilities have been identified in Node. js. A remote attacker can exploit these vulnerabilities to trigger denial of service and security restriction bypass on the targeted system.

Is node.js a security risk? ›

Node. js architecture makes it susceptible to malicious third-party modules. These malicious packages can contain hidden code, credentials, and other malicious attempts at crippling product performance by developers using them.

Is node.js malicious? ›

It's a genuine javascript runtime, though it has been used/abused by malware like Lu0bot.

How many requests can Node.js handle? ›

js can handle approx 15,000 requests per second and the basic HTTP module, 70K requests per second. In another study using 3 Node.

How to fix vulnerabilities in npm NodeJS? ›

Inspecting and fixing the vulnerabilities
  1. Automatic update: Use npm audit fix to automatically update vulnerable dependencies to patched versions. ...
  2. Manual update: Review the report and update specific dependencies. ...
  3. Manual fix: For complex vulnerabilities or those requiring code changes, you might need to dive deeper.
Apr 5, 2024

What are the three main vulnerabilities? ›

The triple vulnerability theory incorporates three sets of predisposition that interact to produce symptoms: (a) generalized biological vulnerability, (b) generalized psychological vulnerability, and (c) specific psychological vulnerability emerging from early learning. ...

What is node js not recommended for? ›

Node. js doesn't support multi-threaded programming yet. It is able to serve way more complicated applications than Ruby, but it's not suitable for performing long-running calculations. Heavy computations block the incoming requests, which can lead to decrease of performance .

What is the problem with node JS? ›

Scalability Challenges: scaling in Node. js doesn't come easy and this is due to the fact that it's a single-threaded process. You might need to divide building many complex applications into smaller microservices that handle different operations.

How to make node.js secure? ›

js project.
  1. Never Run Node. js With Root Privileges. ...
  2. Keep Your NPM Libraries Up To Date. ...
  3. Avoid Using Default Cookie Names. ...
  4. Set the Security HTTP Headers. ...
  5. Implement Rate Limiting. ...
  6. Ensure Strong Authentication Policies. ...
  7. Do Not Send Unnecessary Info. ...
  8. Monitor Your Backend.
Sep 27, 2023

Is NodeJS being replaced? ›

No , the Bun language is not going to replace Node. js . While both are used for server - side programming , they serve different purposes and have different features . Node.

Does anyone still use NodeJS? ›

js still relevant? Node. js is still relevant for web and app development due to its lightweight and efficient nature, cross-platform compatibility, and large active community.

Why NodeJS is not popular? ›

It is not ideal for CPU-intensive tasks

The single-threaded nature of Node. js can limit the utilization of multi-core systems, particularly for CPU-bound applications. This can result in suboptimal performance for projects with significant computational requirements.

Can NodeJS handle high traffic? ›

A: Absolutely! In fact, combining multiple scaling techniques can often yield better results. For example, using load balancing in conjunction with horizontal scaling or employing caching alongside optimized database performance can significantly enhance application scalability and performance.

How to handle 1 million requests per second in NodeJS? ›

Understanding NodeJS and API Requests
  1. Design Efficient APIs. The first step in handling millions of API requests is to design an efficient API architecture. ...
  2. Versioning and Documentation. ...
  3. Use Asynchronous Operations. ...
  4. Implement Caching. ...
  5. Optimize Database Queries. ...
  6. Load Balancing. ...
  7. Horizontal Scaling. ...
  8. Load Testing.
Sep 7, 2023

Is NodeJS synchronous or asynchronous? ›

js. js is an asynchronous event-driven JavaScript runtime and is the most effective when building scalable network applications. Node. js is free of locks, so there's no chance to dead-lock any process.

What are node vulnerabilities? ›

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS).

What are the three 3 types of network service vulnerabilities? ›

According to Puprlesec, 68% of companies in 2022 experienced a targeted attack on their networks and suffered data loss as a direct result.
  • 1) Hardware Vulnerabilities.
  • 2) Software Vulnerabilities.
  • 3) Vulnerabilities Caused By Employees.

How many types of vulnerability are there? ›

Vulnerability Types: 5 Types of Vulnerabilities You Need To Know. A vulnerability is any flaw or weakness within the technology system that cybercriminals can exploit to gain unauthorized access to a network, information assets and software applications.

What are the 3 primary vulnerabilities or weaknesses in a network or a device? ›

Network equipment weakness

Their weaknesses include password protection, lack of authentication, routing protocols, and firewall holes.

Top Articles
Greek Mythology Gods Olympians
How To Fork Ethereum Blockchain with Foundry | QuickNode
Jack Doherty Lpsg
No Hard Feelings (2023) Tickets & Showtimes
55Th And Kedzie Elite Staffing
Bj 사슴이 분수
Tyson Employee Paperless
Chalupp's Pizza Taos Menu
David Packouz Girlfriend
Minn Kota Paws
Over70Dating Login
Craigslist/Phx
Craigslist Labor Gigs Albuquerque
Slmd Skincare Appointment
Newgate Honda
Craigslist Cars Nwi
Dc Gas Login
Craigslist List Albuquerque: Your Ultimate Guide to Buying, Selling, and Finding Everything - First Republic Craigslist
Kürtçe Doğum Günü Sözleri
Locate At&T Store Near Me
2020 Military Pay Charts – Officer & Enlisted Pay Scales (3.1% Raise)
Air Force Chief Results
Ibukunore
Aris Rachevsky Harvard
Sussyclassroom
Www.patientnotebook/Atic
Paris Immobilier - craigslist
Cfv Mychart
Superhot Free Online Game Unblocked
Jail Roster Independence Ks
Prévisions météo Paris à 15 jours - 1er site météo pour l'île-de-France
Strange World Showtimes Near Atlas Cinemas Great Lakes Stadium 16
AP Microeconomics Score Calculator for 2023
Today's Final Jeopardy Clue
Edict Of Force Poe
Jewish Federation Of Greater Rochester
Compare Plans and Pricing - MEGA
303-615-0055
Riverton Wyoming Craigslist
Samantha Lyne Wikipedia
Carroll White Remc Outage Map
The Conners Season 5 Wiki
Sdn Fertitta 2024
The power of the NFL, its data, and the shift to CTV
Craigslist Woodward
Squalicum Family Medicine
Yourcuteelena
Abigail Cordova Murder
60 Second Burger Run Unblocked
Fallout 76 Fox Locations
Houston Primary Care Byron Ga
Lagrone Funeral Chapel & Crematory Obituaries
Latest Posts
Article information

Author: Roderick King

Last Updated:

Views: 6438

Rating: 4 / 5 (71 voted)

Reviews: 86% of readers found this page helpful

Author information

Name: Roderick King

Birthday: 1997-10-09

Address: 3782 Madge Knoll, East Dudley, MA 63913

Phone: +2521695290067

Job: Customer Sales Coordinator

Hobby: Gunsmithing, Embroidery, Parkour, Kitesurfing, Rock climbing, Sand art, Beekeeping

Introduction: My name is Roderick King, I am a cute, splendid, excited, perfect, gentle, funny, vivacious person who loves writing and wants to share my knowledge and understanding with you.