Node.js Security Bulletin: Multiple Vulnerabilities Fixed (CVE-2024-36138, 22020, 36137, 22018, 37372)

From this webpage screenshot, the following key information about the vulnerabilities can be obtained: 1. Vulnerability List: - Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138) - High severity - Bypass network import restriction via data URL (CVE-2024-22020) - Medium severity - fs.fchown/fchmod bypasses permission model (CVE-2024-36137) - Low severity - fs.lstat bypasses permission model (CVE-2024-22018) - Low severity - Permission model improperly processes UNC paths (CVE-2024-37372) - Low severity 2. Affected Versions: - Node.js 22.x - Node.js 20.x - Node.js 18.x 3. Impact of Vulnerabilities: - Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138) - Affects all Windows users utilizing and . - Bypass network import restriction via data URL (CVE-2024-22020) - Affects all users using network imports. - fs.fchown/fchmod bypasses permission model (CVE-2024-36137) - Affects all users using the experimental permission model. - fs.lstat bypasses permission model (CVE-2024-22018) - Affects all users using the experimental permission model. - Permission model improperly processes UNC paths (CVE-2024-37372) - Affects all Windows users using the permission model. 4. Fix Status: - Bypass incomplete fix of CVE-2024-27980 (CVE-2024-36138) - Fixed - Bypass network import restriction via data URL (CVE-2024-22020) - Fixed - fs.fchown/fchmod bypasses permission model (CVE-2024-36137) - Fixed - fs.lstat bypasses permission model (CVE-2024-22018) - Fixed - Permission model improperly processes UNC paths (CVE-2024-37372) - Fixed 5. Release Information: - Node.js v18.20.4 - Node.js v20.15.1 - Node.js v22.4.1 6. Release Dates: - July 8, 2024 - July 4, 2024 7. Contact and Future Updates: - Provides procedures and contact information for reporting vulnerabilities. - Offers a mailing list subscription for security advisories. This information helps users understand the details of the vulnerabilities, affected versions, fix status, and how to report new vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Node.js Security Bulletin: Multiple Vulnerabilities Fixed (CVE-2024-36138, 22020, 36137, 22018, 37372)