9.1
Critique
CVE-2022-35255 A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in…
Description
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Node 18.0 | 18.0 → < 18.9.1 | 18.9.1 |
| Node 17.0 | 17.0 → dernières | Pas de correctif indiqué |
| Node 15.0 | 15.0 → dernières | Pas de correctif indiqué |
| Node 13.0 | 13.0 → dernières | Pas de correctif indiqué |
| Node 12.0 | 12.0 → dernières | Pas de correctif indiqué |
| Node 11.0 | 11.0 → dernières | Pas de correctif indiqué |
| Node 10.0 | 10.0 → dernières | Pas de correctif indiqué |
| Node 9.0 | 9.0 → dernières | Pas de correctif indiqué |
| Node 8.0 | 8.0 → dernières | Pas de correctif indiqué |
Références
- hackerone.com hackerone.com
- cert-portal.siemens.com cert-portal.siemens.com
- security.netapp.com security.netapp.com
- DSA-5326 www.debian.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Node
Les 129 CVE de Node →
CVE-2026-106069
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP…
7.4
Élevée
CVE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*()…
7.4
Élevée
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Moyenne
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a…
7.4
Élevée