{"schema_version":"1.7.2","id":"OESA-2025-1090","modified":"2025-02-08T12:33:39Z","published":"2025-02-08T12:33:39Z","upstream":["CVE-2025-23084","CVE-2025-23085"],"summary":"nodejs security update","details":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nA vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.\n\nOn Windows, a path that does not start with the file separator is treated as relative to the current directory. \n\nThis vulnerability affects Windows users of `path.join` API.(CVE-2025-23084)\n\nA memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.\n\nThis vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.(CVE-2025-23085)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS","name":"nodejs","purl":"pkg:rpm/openEuler/nodejs\u0026distro=openEuler-24.03-LTS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-1.oe2403"}]}],"ecosystem_specific":{"aarch64":["nodejs-20.18.2-1.oe2403.aarch64.rpm","nodejs-debuginfo-20.18.2-1.oe2403.aarch64.rpm","nodejs-debugsource-20.18.2-1.oe2403.aarch64.rpm","nodejs-devel-20.18.2-1.oe2403.aarch64.rpm","nodejs-full-i18n-20.18.2-1.oe2403.aarch64.rpm","nodejs-libs-20.18.2-1.oe2403.aarch64.rpm","npm-10.8.2-1.20.18.2.1.oe2403.aarch64.rpm","v8-devel-11.3.244.8-1.20.18.2.1.oe2403.aarch64.rpm"],"noarch":["nodejs-docs-20.18.2-1.oe2403.noarch.rpm"],"src":["nodejs-20.18.2-1.oe2403.src.rpm"],"x86_64":["nodejs-20.18.2-1.oe2403.x86_64.rpm","nodejs-debuginfo-20.18.2-1.oe2403.x86_64.rpm","nodejs-debugsource-20.18.2-1.oe2403.x86_64.rpm","nodejs-devel-20.18.2-1.oe2403.x86_64.rpm","nodejs-full-i18n-20.18.2-1.oe2403.x86_64.rpm","nodejs-libs-20.18.2-1.oe2403.x86_64.rpm","npm-10.8.2-1.20.18.2.1.oe2403.x86_64.rpm","v8-devel-11.3.244.8-1.20.18.2.1.oe2403.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1090"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23084"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23085"}],"database_specific":{"severity":"Medium"}}