RHSA-2022:6595MediumCVSS 7.5

Red Hat Security Advisory: nodejs and nodejs-nodemon security and bug fix update

Published
September 20, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (10)

CVE-2020-28469 →CVE-2021-3807 →CVE-2021-33502 →CVE-2022-29244 →CVE-2022-32212 →CVE-2022-32213 →CVE-2022-32215 →CVE-2020-7788 →CVE-2022-32214 →CVE-2022-33987 →

📋 Description

CVE-2020-7788 — nodejs-ini: Prototype pollution via malicious INI file CVE-2020-28469 — nodejs-glob-parent: Regular expression denial of service CVE-2021-3807 — nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes CVE-2021-33502 — nodejs-normalize-url: ReDoS for data URLs CVE-2022-29244 — nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace CVE-2022-32212 — nodejs: DNS rebinding in --inspect via invalid IP addresses CVE-2022-32213 — nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding CVE-2022-32214 — nodejs: HTTP request smuggling due to improper delimiting of header fields CVE-2022-32215 — nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding CVE-2022-33987 — nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets

🎯 Affected products37

  • Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:16.16.0-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:16.16.0-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:16.16.0-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:16.16.0-1.el9_0.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-1:16.16.0-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:16.16.0-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:16.16.0-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:16.16.0-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:16.16.0-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debuginfo-1:16.16.0-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:16.16.0-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:16.16.0-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:16.16.0-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:16.16.0-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-debugsource-1:16.16.0-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-docs-1:16.16.0-1.el9_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:16.16.0-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:16.16.0-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:16.16.0-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-full-i18n-1:16.16.0-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:16.16.0-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:16.16.0-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:16.16.0-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:16.16.0-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-1:16.16.0-1.el9_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:16.16.0-1.el9_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:16.16.0-1.el9_0.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:16.16.0-1.el9_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nodejs-libs-debuginfo-1:16.16.0-1.el9_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +7 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (15)