WORLDTECHNode.js Project Ships Fixes for 16 Security Flaws Across Three Release Lines
The Node.js Project has issued security updates for three of its release lines, addressing 16 vulnerabilities, according to a report by GBHackers. The report says many of the flaws can be exploited remotely by clients that have not logged in.
Where the weaknesses sit
According to GBHackers, the flaws are concentrated in the parts of the software that process HTTP/2 traffic and TLS, the encryption layer that protects a connection to a website.
Because many of them can be reached without authentication, the report treats them as a concern for any server running the affected software.
Patched builds named in the report
The report identifies v22.23.5, v24.22.3 and v26.13.1 as the patched builds, one for each of the three lines.
GBHackers describes the issues as capable of crashing remote servers, causing memory leaks and bypassing authentication. The material available to WORLDTECH does not include detailed technical write-ups of individual flaws.
Open questions
- Which of the 16 flaws are the most severe, and which are limited to crashes or memory leaks?
- Are any of these vulnerabilities known to have been exploited in attacks?