9.1
Critique
CVE-2022-35255 A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in…
Description
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Node 18.0 | 18.0 → < 18.9.1 | 18.9.1 |
| Node 17.0 | 17.0 → dernières | Pas de correctif indiqué |
| Node 15.0 | 15.0 → dernières | Pas de correctif indiqué |
| Node 13.0 | 13.0 → dernières | Pas de correctif indiqué |
| Node 12.0 | 12.0 → dernières | Pas de correctif indiqué |
| Node 11.0 | 11.0 → dernières | Pas de correctif indiqué |
| Node 10.0 | 10.0 → dernières | Pas de correctif indiqué |
| Node 9.0 | 9.0 → dernières | Pas de correctif indiqué |
| Node 8.0 | 8.0 → dernières | Pas de correctif indiqué |
Autres CVE de Node
Les 129 CVE de Node →
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Moyenne
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a…
7.4
Élevée
CVE-2026-106069
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP…
7.4
Élevée
CVE-2026-105481
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before…
6.5
Moyenne