nodejs / nodejs/nodejs-dependency-vuln-assessments
Whether V8: CVE-2024-4761, CVE-2024-4947 and/or CVE-2024-5274 has impact on the use of nodejs
Open
Nobody has claimed this yet.
dont-fall-in-threat-model
- Dominant language
- Python
- Stars
- 22
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
In our recent scans we have detected the following CVEs from V8 though its dependency in node.js:
https://nvd.nist.gov/vuln/detail/CVE-2024-4761
https://nvd.nist.gov/vuln/detail/CVE-2024-4947
https://nvd.nist.gov/vuln/detail/CVE-2024-5274
We would like to know if:
- These CVEs do affect node.js if unpatched,
- If there are plans to port this fixes to the V8 versions in use for node 18 and 20, and/or
- if you would be willing to accept patches for fixing these CVEs in V8 branches used by the node versions mentioned above.
Thank you in advance.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the three linked NVD entries and the V8 versions used by Node.js 18 and 20. Determine whether the CVEs affect Node.js and whether fixes or patches are planned or acceptable for those branches; completion would be a documented assessment or maintainer decision.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100