Overview
Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers an event-driven, non-blocking I/O model that makes it lightweight and efficient, and is widely used in web applications and server-side development.
An Denial of Service vulnerability has been identified in Node.js. The issue stems from improper handling of invalid public keys when creating x509 certificates using the crypto.X509Certificate() API. This weakness allows attackers to force interruptions of application processing, leading to a denial of service scenario.
This vulnerability affects specific versions of the package and can result in application crashes and service interruptions. Details on affected versions and reproduction steps are provided below.
Details
Module Info
Affected packages: Node.js
Affected versions: 4.0 < 16.20.1 , 18 < 18.16.1, 20 < 20.3.1
GitHub repository: https://github.com/nodejs/node
Published packages: https://github.com/nodejs/node/releases
Package manager: npm
Fixed in: Node.js NES version 12, 14
Vulnerability Info
The issue was introduced in version 4.0 and stems from improper handling of invalid public keys when creating x509 certificates.
For instance, in a scenario where an invalid public key is provided, if the system attempts to access public key information, the process terminates unexpectedly. This behavior can be exploited by attackers to cause denial of service.
This vulnerability is a result of flawed logic in the certificate creation process, and may allow attackers to disrupt service availability.
- https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
- https://security.netapp.com/advisory/ntap-20240621-0006/
Credits
- Marc Schönefeld
Mitigation
This vulnerability is not fixed upstream due to the release line being EOL. Herodevs has issued patched builds under the NES (Never Ending Support) line.
- Update to a patched LTS version of Node.js
- Leverage a commercial support partner like HeroDevs for post-EOL security.
Refer to the NES documentation for upgrade instructions.
