{"schemaVersion":3,"id":"USN-4796-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"nodejs vulnerabilities\n\nAlexander Minozhenko and James Bunton discovered that Node.js did not\nproperly handle wildcards in name fields of X.509 TLS certificates. An\nattacker could use this vulnerability to execute a machine-in-the-middle-\nattack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)\n\nIt was discovered that Node.js incorrectly handled certain NAPTR responses.\nA remote attacker could possibly use this issue to cause applications using\nNode.js to crash, resulting in a denial of service. This issue only affected\nUbuntu 16.04 ESM. (CVE-2017-1000381)\n\nNikita Skovoroda discovered that Node.js mishandled certain input, leading\nto an out of bounds write. An attacker could use this vulnerability to\ncause a denial of service (crash) or possibly execute arbitrary code. This\nissue only affected Ubuntu 18.04 ESM. (CVE-2018-12115)\n\nArkadiy Tetelman discovered that Node.js improperly handled certain\nmalformed HTTP requests. An attacker could use this vulnerability to inject\nunexpected HTTP requests. This issue only affected Ubuntu 18.04 ESM.\n(CVE-2018-12116)\n\nJan Maybach discovered that Node.js did not time out if incomplete\nHTTP/HTTPS headers were received. An attacker could use this vulnerability\nto cause a denial of service by keeping HTTP/HTTPS connections alive for a\nlong period of time. This issue only affected Ubuntu 18.04 ESM.\n(CVE-2018-12122)\n\nMartin Bajanik discovered that the url.parse() method would return\nincorrect results if it received specially crafted input. An attacker could\nuse this vulnerability to spoof the hostname and bypass hostname-specific\nsecurity controls. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12123)\n\nIt was discovered that Node.js is vulnerable to a DNS rebinding attack which\ncould be exploited to perform remote code execution. An attack is possible\nfrom malicious websites open in a web browser with network access to the system\nrunning the Node.js process. This issue only affected Ubuntu 18.04 ESM.\n(CVE-2018-7160)\n\nIt was discovered that the Buffer.fill() and Buffer.alloc() methods\nimproperly handled certain inputs. An attacker could use this vulnerability\nto cause a denial of service. This issue only affected Ubuntu 18.04 ESM.\n(CVE-2018-7167)\n\nMarco Pracucci discovered that Node.js mishandled HTTP and HTTPS\nconnections. An attacker could use this vulnerability to cause a denial of\nservice. This issue only affected Ubuntu 18.04 ESM. (CVE-2019-5737)","dates":{"published":"2021-03-15T21:18:37.000Z","modified":"2026-06-29T13:48:17.400Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"nodejs","name":"nodejs","label":"nodejs","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/nodejs","purlType":"deb","versions":[{"text":"< 0.10.25~dfsg2-2ubuntu1.2+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 4.2.6~dfsg-1ubuntu4.2+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 8.10.0~dfsg-2ubuntu0.4+esm1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.25~dfsg2-2ubuntu1.2+esm1 | < 4.2.6~dfsg-1ubuntu4.2+esm1 | < 8.10.0~dfsg-2ubuntu0.4+esm1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-4796-1","label":"ubuntu.com/security/notices/USN-4796-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7099","label":"ubuntu.com/security/CVE-2016-7099","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2017-1000381","label":"ubuntu.com/security/CVE-2017-1000381","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-7160","label":"ubuntu.com/security/CVE-2018-7160","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-7167","label":"ubuntu.com/security/CVE-2018-7167","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-12115","label":"ubuntu.com/security/CVE-2018-12115","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-12116","label":"ubuntu.com/security/CVE-2018-12116","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-12122","label":"ubuntu.com/security/CVE-2018-12122","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2018-12123","label":"ubuntu.com/security/CVE-2018-12123","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2019-5737","label":"ubuntu.com/security/CVE-2019-5737","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2016-7099","CVE-2017-1000381","CVE-2018-12115","CVE-2018-12116","CVE-2018-12122","CVE-2018-12123","CVE-2018-7160","CVE-2018-7167","CVE-2019-5737"],"downstream":[],"duplicates":[],"related":["CVE-2016-7099","CVE-2017-1000381","CVE-2018-12115","CVE-2018-12116","CVE-2018-12122","CVE-2018-12123","CVE-2018-7160","CVE-2018-7167","CVE-2019-5737"]},"timeline":[{"kind":"published","date":"2021-03-15T21:18:37.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-29T13:48:17.400Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T03:23:35.618Z","stale":false,"partial":false}}