CVE-2024-37372
Fixed in a distro release EPSS <1%CVSS 3.6
The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.19 | nodejs | 0 |
| Alpine 3.20 | nodejs | 0 |
| Alpine 3.21 | nodejs | 0 |
| Alpine 3.22 | nodejs | 0 |
| Alpine 3.23 | nodejs | 0 |
| Alpine 3.24 | nodejs | 0 |
| Chainguard | nodejs-21 | 21.7.3-r8 |
| Chainguard | nodejs-21-doc | 21.7.3-r8 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs20 | 20.15.1-150500.11.12.2 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP6 | nodejs20 | 20.15.1-150600.3.3.2 |
| Ubuntu 20.04 LTS | nodejs | no fix |
| Ubuntu 22.04 LTS | nodejs | no fix |
| Ubuntu 24.04 LTS | nodejs | no fix |
| Ubuntu 24.10 | nodejs | no fix |
| Ubuntu 25.04 | nodejs | no fix |
| Ubuntu Pro 14.04 LTS | nodejs | no fix |
| Ubuntu Pro 16.04 LTS | nodejs | no fix |
| Ubuntu Pro 18.04 LTS | nodejs | no fix |
| Wolfi | nodejs-21 | 21.7.3-r8 |
| Wolfi | nodejs-21-doc | 21.7.3-r8 |
| openSUSE Leap 15.5 | nodejs20 | 20.15.1-150500.11.12.2 |
| openSUSE Leap 15.6 | nodejs20 | 20.15.1-150600.3.3.2 |
| openSUSE Tumbleweed | nodejs20 | 20.15.1-1.1 |
| openSUSE Tumbleweed | nodejs22 | 22.10.0-1.1 |
| openSUSE Tumbleweed | nodejs24 | 24.11.1-2.1 |
| openSUSE Tumbleweed | nodejs26 | 26.3.1-1.1 |