A new alert, derived from the previous posts, because it doesn’t directly concern the installation of Node.js, but one of its possible imports.
The flaw we’re talking about today stems from the import of the libuv library into Node.js.
For information or reminder libuv is mainly used to support asynchronous I/O based on event loops.
Its flaw stems from a possible server-side request forgery, caused by a bad domain lookup by the uv_getaddrinfo function in src/unix/getaddrinfo.c.
By sending a specially crafted request, an attacker can exploit this vulnerability to carry out a Server-Side Request Forgery (SSRF) attack.
CVSS score 7.3.
To correct this flaw, simply update Node.js to version LTS 18.
You can find details of this flaw by clicking on the attached link:(https://lnkd.in/eD2TC6tR)
