Alpine: multiple nodejs packages: security update to 16.17.1-r0

critical Tenable Self-Hosted Container Security Plugin ID 424239

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse
and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). (CVE-2022-32213)

- The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use
the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
(CVE-2022-32214)

- The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly
handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
(CVE-2022-32215)

- A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with
EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems
with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can
(and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically
strong and therefore not suitable as keying material. (CVE-2022-35255)

- The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not
terminated with CLRF. This may result in HTTP Request Smuggling. (CVE-2022-35256)

Plugin Details

Severity: Critical

ID: 424239

Version: Revision 1.8

Type: Local

Family: Alpine Linux Local Security Checks

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2022-35255

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 7/8/2022

Reference Information

CVE: CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-35255, CVE-2022-35256

Detections

Analytics