title: Red Hat Security Advisory: nodejs security, bug fix, and enhancement update
description: c-ares: buffer overflow in config_sortlist() due to missing string length check http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability Node.js: insecure loading of ICU data through ICU_DATA environment variable Node.js: Fetch API did not protect against CRLF injection in host headers Node.js: Regular Expression Denial of Service in Headers fetch API nodejs: mainModule.proto bypass experimental policy mechanism nodejs: process interuption due to invalid Public Key information in x509 certificates nodejs: HTTP Request Smuggling via Empty headers separated by CR nodejs: DiffieHellman do not generate keys after setting a private key nodejs: Permissions policies can be bypassed via Module._load nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() nodejs: Permissions policies can be bypassed via process.binding
cpes: cpe:/a:redhat:rhel_eus:9.0::appstream