Overview

The Node.js Project issued a CVE for End-of-Life (EOL) versions of Node.js. This CVE aims to raise awareness about the risks of running unsupported versions and to encourage users to upgrade to actively maintained releases, given that v16 and v14 which are still widely used.

Vulnerability Info

The CVE will serve as an official acknowledgment that EOL versions of Node.js are no longer maintained and may expose users to significant security vulnerabilities. It will cite Unsupported When Assigned under CWE-1104: Use of Unmaintained Third Party Components. This classification highlights the inherent risks of relying on outdated software. All versions of Node.js before v18 are to be considered vulnerable. The Node.js team does not test the reproducibility of new CVEs on EOL versions.

Many of the core dependencies of Node.js have released several CVE that might affect EOL versions.

OpenSSL

Older versions of Node.js before v17  rely on OpenSSL v1, which has itself reached end-of-life. OpenSSL v1 is known to have several high  security vulnerabilities.

This is particularly risky because Node.js depends on OpenSSL for all cryptographic operations, making these versions especially susceptible to exploitation.

Some of the OpenSSL vulnerabilities that might affect EOL versions of  Node.js are:

• Denial of Service through maliciously formatted PKCS12
• Remote code execution
• Certificate Spoofing
• Memory corruption

‍

llhttp

A web application running an EOL version of Node.js may rely on a vulnerable version of llhttp, the HTTP parser. This exposes the server to risks such as HTTP request smuggling and denial-of-service attacks. An attacker could exploit these vulnerabilities by crafting and sending malicious HTTP packets.

Some of the vulnerabilities that might affect EOL versions of  Node.js are:

• Request Smuggling via Improper Delimiting of Header Fields
• Request Smuggling via Flawed Parsing of Transfer-Encoding
• Request Smuggling via Flawed Parsing of Transfer-Encoding

‍

Several other libraries used in Node.js have released CVEs that might affect users:

• nghttp2 Denial of service vulnerability in nghttp2
• zlib Denial of service or code execution
• c-ares Denial of service
• npm Improper Link Resolution Before File Access

Mitigation

To mitigate these Node.js security risks, users should take one of the following steps:

• Move to secure versions of Node.js.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍