RHSA-2022:6449MediumCVSS 7.5

Red Hat Security Advisory: nodejs:16 security and bug fix update

Published
September 13, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (6)

CVE-2021-3807 →CVE-2022-32212 →CVE-2022-32213 →CVE-2022-32214 →CVE-2022-32215 →CVE-2022-33987 →

📋 Description

CVE-2021-3807 — nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes CVE-2022-32212 — nodejs: DNS rebinding in --inspect via invalid IP addresses CVE-2022-32213 — nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding CVE-2022-32214 — nodejs: HTTP request smuggling due to improper delimiting of header fields CVE-2022-32215 — nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding CVE-2022-33987 — nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets

🎯 Affected products31

  • Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:16.16.0-3.module+el8.6.0+16248+76b0e185.aarch64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:16.16.0-3.module+el8.6.0+16248+76b0e185.ppc64le (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:16.16.0-3.module+el8.6.0+16248+76b0e185.s390x (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:16.16.0-3.module+el8.6.0+16248+76b0e185.src (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:16.16.0-3.module+el8.6.0+16248+76b0e185.x86_64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:16.16.0-3.module+el8.6.0+16248+76b0e185.aarch64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:16.16.0-3.module+el8.6.0+16248+76b0e185.ppc64le (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:16.16.0-3.module+el8.6.0+16248+76b0e185.s390x (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:16.16.0-3.module+el8.6.0+16248+76b0e185.x86_64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:16.16.0-3.module+el8.6.0+16248+76b0e185.aarch64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:16.16.0-3.module+el8.6.0+16248+76b0e185.ppc64le (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:16.16.0-3.module+el8.6.0+16248+76b0e185.s390x (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:16.16.0-3.module+el8.6.0+16248+76b0e185.x86_64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:16.16.0-3.module+el8.6.0+16248+76b0e185.aarch64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:16.16.0-3.module+el8.6.0+16248+76b0e185.ppc64le (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:16.16.0-3.module+el8.6.0+16248+76b0e185.s390x (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:16.16.0-3.module+el8.6.0+16248+76b0e185.x86_64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-docs-1:16.16.0-3.module+el8.6.0+16248+76b0e185.noarch (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:16.16.0-3.module+el8.6.0+16248+76b0e185.aarch64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:16.16.0-3.module+el8.6.0+16248+76b0e185.ppc64le (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:16.16.0-3.module+el8.6.0+16248+76b0e185.s390x (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:16.16.0-3.module+el8.6.0+16248+76b0e185.x86_64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:2.0.19-2.module+el8.6.0+16240+7ca51420.noarch (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:2.0.19-2.module+el8.6.0+16240+7ca51420.src (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:8.11.0-1.16.16.0.3.module+el8.6.0+16248+76b0e185.aarch64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:8.11.0-1.16.16.0.3.module+el8.6.0+16248+76b0e185.ppc64le (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:8.11.0-1.16.16.0.3.module+el8.6.0+16248+76b0e185.s390x (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +1 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (10)