title: Red Hat Security Advisory: nodejs:12 security and bug fix update
description: c-ares: Missing input validation of host names may lead to domain hijacking libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes nodejs: Use-after-free on close http2 on stream canceling nodejs: Improper handling of untypical characters in domain names nodejs: Incomplete validation of tls rejectUnauthorized parameter nodejs: Use-after-free on close http2 on stream canceling nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite
cpes: cpe:/a:redhat:rhel_eus:8.1::appstream