Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux Node.js may allow request hijacking
published 4 years ago
Summary
The Node.js packages for AlmaLinux can be tricked into processing forged web requests, which could let attackers interfere with data or redirect traffic. Updating to the latest Node.js release for AlmaLinux resolves these parsing and redirect errors. Apply the provided security update as soon as possible to keep your applications safe.
What to do
- Update almalinux nodejs to version 1:14.20.0-2.module_el8.6.0+3261+490666b3.
- Update almalinux nodejs-devel to version 1:14.20.0-2.module_el8.6.0+3261+490666b3.
- Update almalinux nodejs-docs to version 1:14.20.0-2.module_el8.6.0+3261+490666b3.
- Update almalinux nodejs-full-i18n to version 1:14.20.0-2.module_el8.6.0+3261+490666b3.
- Update almalinux nodejs-nodemon to version 2.0.19-2.module_el8.6.0+3261+490666b3.
- Update almalinux nodejs-packaging to version 23-3.module_el8.5.0+2618+8d46dafd.
- Update almalinux npm to version 1:6.14.17-1.14.20.0.2.module_el8.6.0+3261+490666b3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | nodejs |
< 1:14.20.0-2.module_el8.6.0+3261+490666b3 Fix: upgrade to 1:14.20.0-2.module_el8.6.0+3261+490666b3
|
| AlmaLinux:8 | almalinux | nodejs-devel |
< 1:14.20.0-2.module_el8.6.0+3261+490666b3 Fix: upgrade to 1:14.20.0-2.module_el8.6.0+3261+490666b3
|
| AlmaLinux:8 | almalinux | nodejs-docs |
< 1:14.20.0-2.module_el8.6.0+3261+490666b3 Fix: upgrade to 1:14.20.0-2.module_el8.6.0+3261+490666b3
|
| AlmaLinux:8 | almalinux | nodejs-full-i18n |
< 1:14.20.0-2.module_el8.6.0+3261+490666b3 Fix: upgrade to 1:14.20.0-2.module_el8.6.0+3261+490666b3
|
| AlmaLinux:8 | almalinux | nodejs-nodemon |
< 2.0.19-2.module_el8.6.0+3261+490666b3 Fix: upgrade to 2.0.19-2.module_el8.6.0+3261+490666b3
|
| AlmaLinux:8 | almalinux | nodejs-packaging |
< 23-3.module_el8.5.0+2618+8d46dafd Fix: upgrade to 23-3.module_el8.5.0+2618+8d46dafd
|
| AlmaLinux:8 | almalinux | npm |
< 1:6.14.17-1.14.20.0.2.module_el8.6.0+3261+490666b3 Fix: upgrade to 1:6.14.17-1.14.20.0.2.module_el8.6.0+3261+490666b3
|
Original advisory text
Moderate: nodejs:14 security and bug fix update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)
* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)
* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)
* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)
* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* nodejs:14/nodejs: rebase to latest upstream release (BZ#2106367)
* nodejs:14/nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2111417)
Security Fix(es):
* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)
* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)
* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)
* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)
* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* nodejs:14/nodejs: rebase to latest upstream release (BZ#2106367)
* nodejs:14/nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2111417)
References
- https://access.redhat.com/errata/RHSA-2022:6448 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-32212 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-32213 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-32214 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-32215 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-33987 Third Party Advisory
- https://bugzilla.redhat.com/2102001 Third Party Advisory
- https://bugzilla.redhat.com/2105422 Third Party Advisory
- https://bugzilla.redhat.com/2105426 Third Party Advisory
- https://bugzilla.redhat.com/2105428 Third Party Advisory
- https://bugzilla.redhat.com/2105430 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2022-6448.html Vendor Advisory
Timeline
Published13 Sep 2022
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2022:6448 · OSV
Track software like this
Free during beta