Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious
    payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison
    cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the
    underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the
    HTTP header names. (CVE-2020-8201)

  - Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests
    submission which can make the server unable to accept new connections. (CVE-2020-8251)

The remote host is affected by the vulnerability described in GLSA-202101-07 (NodeJS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in NodeJS. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The version of libuv installed on the remote host is prior to 1.39.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1581 advisory.

    Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious     payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison     cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the     underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the     HTTP header names. (CVE-2020-8201)

    A flaw was found in Node.js 14.x, in versions before 14.11, where it is vulnerable to a denial of service     caused by delayed requests. When used as an edge server, this flaw allows an attacker to initiate a large     number of HTTP requests, causing resource exhaustion and leaving the service unable to accept new     connections. The highest threat from this vulnerability is to system availability. (CVE-2020-8251)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 14.15.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Node.js installed on the remote host is prior to 10.22.1 or 12.18.4 or 14.11.0. It is, therefore, affected by multiple vulnerabilities as referenced in the september-2020-security-releases advisory.

  - Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing.
    This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.
    (CVE-2020-8201)

  - Node.js is vulnerable to HTTP denial of service (DOS) attacks based on delayed requests submission which     can make the server unable to accept new connections. The fix a new http.Server option called requestTimeout     with a default value of 0 which means it is disabled by default. This should be set when Node.js is used     as an edge server. (CVE-2020-8251)

  - libuv's realpath implementation incorrectly determined the buffer size which can result in a buffer overflow     if the resolved path is longer than 256 bytes. (CVE-2020-8252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Node.js reports :

Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues. HTTP Request Smuggling due to CR-to-Hyphen conversion (High) (CVE-2020-8201) Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.

Impacts :

- All versions of the 14.x and 12.x releases line Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical) (CVE-2020-8251) Node.js is vulnerable to HTTP denial of service (DOS) attacks based on delayed requests submission which can make the server unable to accept new connections. The fix a new http.Server option called requestTimeout with a default value of 0 which means it is disabled by default. This should be set when Node.js is used as an edge server, for more details refer to the documentation.

Impacts :

- All versions of the 14.x release line fs.realpath.native on may cause buffer overflow (Medium) (CVE-2020-8252) libuv's realpath implementation incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Impacts :

- All versions of the 10.x release line

- All versions of the 12.x release line

- All versions of the 14.x release line before 14.9.0

ID	Name	Product	Family	Severity
405839	Alpine: multiple nodejs-current packages: security update to 14.11.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405839	Alpine: multiple nodejs-current packages: security update to 14.11.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400338	Alpine: multiple nodejs-current packages: security update to 14.9.0-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400338	Alpine: multiple nodejs-current packages: security update to 14.9.0-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
144864	GLSA-202101-07 : NodeJS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
144797	Amazon Linux 2 : libuv (ALAS-2021-1581)	Nessus	Amazon Linux Local Security Checks	high
144124	Fedora 33 : 1:nodejs (2020-43d5a372fc)	Nessus	Fedora Local Security Checks	high
140795	Node.js Multiple Vulnerabilities (September 2020 Security Releases)	Nessus	Misc.	high
140627	FreeBSD : Node.js -- September 2020 Security Releases (4ca5894c-f7f1-11ea-8ff8-0022489ad614)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2020-8251

high

Tenable Plugins

high

high

high

high

high

high

high

high

high