RHSA-2022:9073MediumCVSS 8.2

Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Published
December 15, 2022
Last Modified
September 11, 2026

🔗 CVE IDs covered (7)

CVE-2021-44906 →CVE-2022-3517 →CVE-2022-21824 →CVE-2022-43548 →CVE-2021-44531 →CVE-2021-44532 →CVE-2021-44533 →

📋 Description

CVE-2021-44531 — nodejs: Improper handling of URI Subject Alternative Names CVE-2021-44532 — nodejs: Certificate Verification Bypass via String Injection CVE-2021-44533 — nodejs: Incorrect handling of certificate subject and issuer fields CVE-2021-44906 — minimist: prototype pollution CVE-2022-3517 — nodejs-minimatch: ReDoS via the braceExpand function CVE-2022-21824 — nodejs: Prototype pollution via console.table properties CVE-2022-43548 — nodejs: DNS rebinding in inspect via invalid octal IP address

🎯 Affected products31

  • Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.src (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-docs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.noarch (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.x86_64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.noarch (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b.src (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.src (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.aarch64 (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.ppc64le (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74.s390x (nodejs:16) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +1 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (11)