10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.2 High
AI Score
Confidence
High
0.022 Low
EPSS
Percentile
89.6%
Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues.
The llhttp
parser in the http
module does not correctly parse and validate Transfer-Encoding
headers. This can lead to HTTP Request Smuggling (HRS).
More details will be available at CVE-2022-32213 after publication.
Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability.
Impacts:
llhttp
v6.0.7 and llhttp
v2.1.5 contains the fixes that were updated inside Node.jsThe llhttp
parser in the http
module does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
More details will be available at CVE-2022-32214 after publication.
Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability.
Impacts:
llhttp
v6.0.7 and llhttp
v2.1.5 contains the fixes that were updated inside Node.jsThe llhttp
parser in the http
module does not correctly handle multi-line Transfer-Encoding
headers. This can lead to HTTP Request Smuggling (HRS).
More details will be available at CVE-2022-32215 after publication.
Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability.
Impacts:
llhttp
v6.0.7 and llhttp
v2.1.5 contains the fixes that were updated inside Node.jsThe IsAllowedHost
check can easily be bypassed because IsIPAddress
does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided (for instance 10.0.2.555 is provided), browsers (such as Firefox) will make DNS requests to the DNS server, providing a vector for an attacker-controlled DNS server or a MITM who can spoof DNS responses to perform a rebinding attack and hence connect to the WebSocket debugger, allowing for arbitrary code execution. This is a bypass of CVE-2021-22884.
More details will be available at CVE-2022-32212 after publication.
Thank you to Axel Chong for reporting this vulnerability.
Impacts:
This vulnerability can be exploited if the victim has the following dependencies on Windows machine:
Whenever the above conditions are present, node.exe
will search for providers.dll
in the current user directory. After that, node.exe
will try to search for providers.dll
by the DLL Search Order in Windows.
It is possible for an attacker to place the malicious file providers.dll
under a variety of paths and exploit this vulnerability.
More details will be available at CVE-2022-32223 after publication.
Thank you to Yakir Kadkoda from Aqua Security for reporting this vulnerability.
Impacts:
Note:
Node.js can use an OpenSSL configuration file by specifying the environment variable OPENSSL_CONF
, or using the command line option --openssl-conf
, and if none of those are specified will default to reading the default OpenSSL configuration file openssl.cnf
. Node.js will only read a section that is by default named nodejs_conf
.
If your installation was using the default openssl.cnf
file and is affected by this breaking change you can fall back to the previous behavior by:
--openssl-shared-config
to the command line (Node.js 18.5.0 only); ornodejs_conf
section in that file and copying the contents of the default section into the new nodejs_conf
section.openssl.cnf
from /home/iojs/build/
upon startup (Medium)(CVE-2022-32222)When Node.js starts on linux based systems, it attempts to read /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf
, which ordinarily doesn’t exist. On some shared systems an attacker may be able create this file and therefore affect the default OpenSSL configuration for other users.
Thank you to Michael Scovetta from the OpenSSF Alpha-Omega project for reporting this vulnerability.
Impacts:
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn’t written. In the special case of “in place” encryption, sixteen bytes of the plaintext would be revealed.
Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected.
Impacts:
The Node.js Security Releases will be available on, or shortly after, Thursday, July 7th, 2022.
With respect to the vulnerabilities in the OpenSSL Security releases of Jul 5th 2022 affects Node.js v18.x, v16.x, and v14.x.
The security release will be delayed so that we can incorporate the the updated OpenSSL versions. We will post another update once we have an updated target for the release date.
Our assessment of the security advisory is:
This vulnerability affects OpenSSL 3.0.4 users. However, Node.js has not shipped any version that used OpenSSL 3.0.4. Therefore, Node.js is not affected.
This vulnerability affects Windows 32-Bit x86 users using AES OCB
encryption. The serverity is MODERATE.
The OpenSSL versions 1.1.1q and 3.0.5 will be released July, 5th 2022. The announcement can be found here: <https://mta.openssl.org/pipermail/openssl-announce/2022-July/000229.html>
The Node.js team will evaluate the OpenSSL changes when they are available and then announce the new target date by Thursday or earlier.
The Node.js project will release new versions of the 14.x, 16.x, and 18.x releases lines on or shortly after Tuesday, July 5th, 2022 in order to address:
The 18.x release line of Node.js is vulnerable to three medium severity issues and one high severity issues.
The 16.x release line of Node.js is vulnerable to three medium severity issues and two high severity issues.
The 14.x release line of Node.js is vulnerable to three medium severity issues and two high severity issues.
Releases will be available on, or shortly after, Tuesday, July 5th, 2022.
However, when details of the OpenSSL defects are released on the 5th, our team will be making a more detailed assessment on the likely severity for Node.js users.
The OpenSSL release may delay the Node.js release date. See OpenSSL Security Release
Please monitor the nodejs-sec Google Group for updates, including a decision within 24 hours after the OpenSSL release regarding release timing, and full details of the defects upon eventual release: <https://groups.google.com/forum/#!forum/nodejs-sec>
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.2 High
AI Score
Confidence
High
0.022 Low
EPSS
Percentile
89.6%