RafaelGSS/is-my-node-vulnerable RafaelGSS/is-my-node-vulnerable

  • Stars
    star
    165
  • Rank 228,906 (Top 5 %)
  • Language
    JavaScript
  • License
    MIT License
  • Created almost 2 years ago
  • Updated 22 days ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
RafaelGSS/is-my-node-vulnerable
github

RafaelGSS

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

package that checks if your Node.js installation is vulnerable to known security vulnerabilities

is-my-node-vulnerable

This package helps ensure the security of your Node.js installation by checking for known vulnerabilities. It compares the version of Node.js you have installed (process.version) to the Node.js Security Database and alerts you if a vulnerability is found.

Usage

npx is-my-node-vulnerable

It's strongly recommended to include this as a step in the app CI.

Output - When vulnerable

$ node -v
v20.3.0
$ npx is-my-node-vulnerable


โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ       โ–ˆโ–ˆ      โ–ˆโ–ˆ   โ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆ โ–ˆโ–ˆ  โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ  โ–ˆโ–ˆ โ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ      โ–ˆโ–ˆ   โ–ˆโ–ˆ
โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ


The current Node.js version (v20.3.0) is vulnerable to the following CVEs:

CVE-2023-30581: The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition
Patched versions: ^16.20.1 || ^18.16.1 || ^20.3.1
==================================================================================================================================================================================

Output - When non-vulnerable

$ node -v
v20.11.1
$ npx is-my-node-vulnerable


 โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ      โ–ˆโ–ˆ           โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ         โ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ      โ–ˆโ–ˆ          โ–ˆโ–ˆ       โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ     โ–ˆโ–ˆ  โ–ˆโ–ˆ
โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆ      โ–ˆโ–ˆ          โ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ         โ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ      โ–ˆโ–ˆ          โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ     โ–ˆโ–ˆ  โ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ      โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ         โ–ˆโ–ˆ

Output - when end of life

$ node -v
v15.14.0
$ npx is-my-node-vulnerable
โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ       โ–ˆโ–ˆ      โ–ˆโ–ˆ   โ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆ โ–ˆโ–ˆ  โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ  โ–ˆโ–ˆ โ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ      โ–ˆโ–ˆ   โ–ˆโ–ˆ
โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ


v15.14.0 is end-of-life. There are high chances of being vulnerable. Please upgrade it.

End-of-Life versions don't keep track of recent security releases, therefore, it's considered vulnerable by default.

API

This package also exports a function isNodeVulnerable to perform the check in runtime

const { isNodeVulnerable } = require('is-my-node-vulnerable')

isNodeVulnerable('19.0.0') // true

Optionally you can define the platform with the argument platform to limit the scope. The available platforms are the same values available in for os.platform().

const { isNodeVulnerable } = require('is-my-node-vulnerable')

isNodeVulnerable('19.0.0', 'linux') // true

Github Action

This package also provide a Github Action, just include the node-version in the yml as follows in order to check an specific version:

name: "Node.js Vulnerabilities"
on: 
  schedule:
    - cron: "0 0 * * *"

jobs:
  is-my-node-vulnerable:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Check Node.js
        uses: RafaelGSS/[email protected]
        with:
          node-version: "18.14.1"

Optionally you can define the platform with the argument platform to limit the scope. The available platforms are the same values available in for os.platform().

      - uses: actions/checkout@v3
      - name: Check Node.js
        uses: RafaelGSS/[email protected]
        with:
          node-version: "18.14.1"
          platform: "linux"

More Repositories

1

nodejs-bench-operations

Is X faster than Y in Node.js vX.Z?
JavaScript
266
star
2

bench-node

A powerful Node.js benchmark library
JavaScript
64
star
3

HyzMall

๐ŸŽฉ RAT - HTTP based. Undetectable!
C++
54
star
4

napd

Node API Project Design - CLI for generate structure base of api.
JavaScript
29
star
5

autobench

Benchmark your application on CI
JavaScript
26
star
6

state-of-nodejs-performance-2023

Raw results of State of Node.js Performance 2023 article
Shell
21
star
7

microservice-example

Just example of architecture microservices with API Gateway/Management and MQTT
JavaScript
18
star
8

fastify-amqp

Plugin with interface to AMQP protocol - RabbitMQ
JavaScript
17
star
9

nodejs-cpu-cache

JavaScript
16
star
10

dotfiles

Heart of development.
Vim Script
11
star
11

node-architeture-project-design

๐Ÿ“‘ A Node.js service structure - Package CLI (napd)
JavaScript
11
star
12

microservices

List of articles and repositories created by me about Microservices Architecture.
10
star
13

gonzagajs

Library to create amazing things
JavaScript
8
star
14

notify-me

Get notified when a task execute with success
Shell
8
star
15

microservice-debezium-outbox

POC - Outbox Pattern refers my article/talk
JavaScript
7
star
16

is-all-about-performance-slides

15min slides
Vue
7
star
17

nodejs-stats

Jupyter Notebook
7
star
18

function-perf

Measure the performance of an function easily
TypeScript
6
star
19

geek4geek

Front-end Ecommerce Geek4Geek ๐Ÿš€
Vue
6
star
20

awesome-nodejs-benchmark

A collection of resources regarding Node.js benchmark
6
star
21

autobench-example

Example of Autobench usage in Nodejs application
JavaScript
5
star
22

blog

My personal blog โญ
Elixir
4
star
23

kafka-load-consumer

Application to make asynchronous message on kafka. Proposes load tests on Event Driven application
JavaScript
3
star
24

HappyAnalytics

๐Ÿ˜ Slack bot created on Hackathon Code In Quero 2018.
Python
3
star
25

bad-action

Showing in practice why you should pin your actions by commit-hash
Shell
2
star
26

RafaelGSS

2
star
27

cpp-bench-operations

C++
2
star
28

state-of-nodejs-performance-2024

Shell
2
star
29

vue-from-scratch

Vue from scratch with Webpack4 ๐Ÿš€
JavaScript
2
star
30

k8s

Template to microsservices project
JavaScript
2
star
31

dont-serve-static-files

A practical example why you shouldn't serve static files in the application layer
HTML
2
star
32

fastify-ms-auth

Example authentication with fastify
JavaScript
2
star
33

flash-profiler

A lightweight profiler for Node.js
C++
2
star
34

rabbitmq-workflow-example

Just a example of workflow with Message Brokers like RabbitMQ.
JavaScript
2
star
35

geek4geek.admin

CSS
2
star
36

ossummit-china

2
star
37

nodejs-benchmark-coverage

JavaScript
2
star
38

nodejs-bench-alternatives

Compare packages
JavaScript
2
star
39

nodejs-webstreams-perf

JavaScript
2
star
40

cidao-bot

Discord bot just for fun
TypeScript
1
star
41

MinesweeperEngine

๐ŸŽฒEngine of the Minesweeper
Ruby
1
star
42

test-gh-pr-referral

Test fork referral
1
star
43

VHelper.site

HTML
1
star
44

nest-starter

Example of usage with absolute paths
TypeScript
1
star
45

tcp-netw

Simple client and server communication.
C
1
star
46

VHelper

Screen Reader more optmized
C++
1
star
47

node-playground

๐ŸŽฎ Playing with Libuv and Node Core concepts
HTML
1
star
48

fastify-conditional-requests

Use ETag to Preconditional requests to solve concurrency requests.
TypeScript
1
star
49

portfolio

Vue
1
star
50

nodejs-alert-eventloop-blockage

1
star
51

nodejs-v8-flags

JavaScript
1
star
52

geek4geek.api

JavaScript
1
star
53

PyCam

๐Ÿ“ท Face recognition based on LBPH Algorithm and Filters in real-time image.
Python
1
star
54

vpn-router-cpp

Example of router by sockets
C
1
star
55

fastify-fp-types

Reproduction code
TypeScript
1
star
56

using-bad-action

1
star
57

mit-6172

Some codes from lectures at MIT 6172
C
1
star
58

open-apm-sdk-node

Open APM SDK for NodeJS
JavaScript
1
star
59

benchmark-pr-example

Lab repository
1
star