RafaelGSS/is-my-node-vulnerable RafaelGSS/is-my-node-vulnerable

  • Stars
    star
    121
  • Rank 292,341 (Top 6 %)
  • Language
    JavaScript
  • License
    MIT License
  • Created over 1 year ago
  • Updated 3 months ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
RafaelGSS/is-my-node-vulnerable
github

RafaelGSS

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

package that checks if your Node.js installation is vulnerable to known security vulnerabilities

is-my-node-vulnerable

This package helps ensure the security of your Node.js installation by checking for known vulnerabilities. It compares the version of Node.js you have installed (process.version) to the Node.js Security Database and alerts you if a vulnerability is found.

Usage

npx is-my-node-vulnerable

It's strongly recommended to include this as a step in the app CI.

Output - When vulnerable

$ node -v
v20.3.0
$ npx is-my-node-vulnerable


โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ       โ–ˆโ–ˆ      โ–ˆโ–ˆ   โ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆ โ–ˆโ–ˆ  โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ  โ–ˆโ–ˆ โ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ      โ–ˆโ–ˆ   โ–ˆโ–ˆ
โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ


The current Node.js version (v20.3.0) is vulnerable to the following CVEs:

CVE-2023-30581: The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition
Patched versions: ^16.20.1 || ^18.16.1 || ^20.3.1
==================================================================================================================================================================================

Output - When non-vulnerable

$ node -v
v20.11.1
$ npx is-my-node-vulnerable


 โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ      โ–ˆโ–ˆ           โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ         โ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ      โ–ˆโ–ˆ          โ–ˆโ–ˆ       โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ     โ–ˆโ–ˆ  โ–ˆโ–ˆ
โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆ      โ–ˆโ–ˆ          โ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ         โ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ      โ–ˆโ–ˆ          โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ     โ–ˆโ–ˆ  โ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ      โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ         โ–ˆโ–ˆ

Output - when end of life

$ node -v
v15.14.0
$ npx is-my-node-vulnerable
โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆ    โ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ       โ–ˆโ–ˆ      โ–ˆโ–ˆ   โ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆ โ–ˆโ–ˆ  โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ
โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ  โ–ˆโ–ˆ โ–ˆโ–ˆ โ–ˆโ–ˆ    โ–ˆโ–ˆ โ–ˆโ–ˆ      โ–ˆโ–ˆ   โ–ˆโ–ˆ
โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆ   โ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ  โ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆโ–ˆ โ–ˆโ–ˆ   โ–ˆโ–ˆ


v15.14.0 is end-of-life. There are high chances of being vulnerable. Please upgrade it.

End-of-Life versions don't keep track of recent security releases, therefore, it's considered vulnerable by default.

API

This package also exports a function isNodeVulnerable to perform the check in runtime

const { isNodeVulnerable } = require('is-my-node-vulnerable')

isNodeVulnerable('19.0.0') // true

Optionally you can define the platform with the argument platform to limit the scope. The available platforms are the same values available in for os.platform().

const { isNodeVulnerable } = require('is-my-node-vulnerable')

isNodeVulnerable('19.0.0', 'linux') // true

Github Action

This package also provide a Github Action, just include the node-version in the yml as follows in order to check an specific version:

name: "Node.js Vulnerabilities"
on: 
  schedule:
    - cron: "0 0 * * *"

jobs:
  is-my-node-vulnerable:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Check Node.js
        uses: RafaelGSS/[email protected]
        with:
          node-version: "18.14.1"

Optionally you can define the platform with the argument platform to limit the scope. The available platforms are the same values available in for os.platform().

      - uses: actions/checkout@v3
      - name: Check Node.js
        uses: RafaelGSS/[email protected]
        with:
          node-version: "18.14.1"
          platform: "linux"

More Repositories

1

nodejs-bench-operations

Is X faster than Y in Node.js vX.Z?
JavaScript
256
star
2

HyzMall

๐ŸŽฉ RAT - HTTP based. Undetectable!
C++
54
star
3

napd

Node API Project Design - CLI for generate structure base of api.
JavaScript
29
star
4

autobench

Benchmark your application on CI
JavaScript
26
star
5

bench-node

require('node:benchmark')
JavaScript
22
star
6

state-of-nodejs-performance-2023

Raw results of State of Node.js Performance 2023 article
Shell
20
star
7

microservice-example

Just example of architecture microservices with API Gateway/Management and MQTT
JavaScript
18
star
8

fastify-amqp

Plugin with interface to AMQP protocol - RabbitMQ
JavaScript
17
star
9

nodejs-cpu-cache

JavaScript
15
star
10

dotfiles

Heart of development.
Vim Script
11
star
11

node-architeture-project-design

๐Ÿ“‘ A Node.js service structure - Package CLI (napd)
JavaScript
11
star
12

microservices

List of articles and repositories created by me about Microservices Architecture.
10
star
13

gonzagajs

Library to create amazing things
JavaScript
7
star
14

microservice-debezium-outbox

POC - Outbox Pattern refers my article/talk
JavaScript
7
star
15

notify-me

Get notified when a task execute with success
Shell
7
star
16

is-all-about-performance-slides

15min slides
Vue
7
star
17

function-perf

Measure the performance of an function easily
TypeScript
6
star
18

geek4geek

Front-end Ecommerce Geek4Geek ๐Ÿš€
Vue
6
star
19

nodejs-stats

Jupyter Notebook
6
star
20

awesome-nodejs-benchmark

A collection of resources regarding Node.js benchmark
5
star
21

blog

My personal blog โญ
Elixir
4
star
22

autobench-example

Example of Autobench usage in Nodejs application
JavaScript
4
star
23

kafka-load-consumer

Application to make asynchronous message on kafka. Proposes load tests on Event Driven application
JavaScript
3
star
24

HappyAnalytics

๐Ÿ˜ Slack bot created on Hackathon Code In Quero 2018.
Python
3
star
25

bad-action

Showing in practice why you should pin your actions by commit-hash
Shell
2
star
26

RafaelGSS

2
star
27

cpp-bench-operations

C++
2
star
28

vue-from-scratch

Vue from scratch with Webpack4 ๐Ÿš€
JavaScript
2
star
29

k8s

Template to microsservices project
JavaScript
2
star
30

dont-serve-static-files

A practical example why you shouldn't serve static files in the application layer
HTML
2
star
31

fastify-ms-auth

Example authentication with fastify
JavaScript
2
star
32

flash-profiler

A lightweight profiler for Node.js
C++
2
star
33

rabbitmq-workflow-example

Just a example of workflow with Message Brokers like RabbitMQ.
JavaScript
2
star
34

geek4geek.admin

CSS
2
star
35

ossummit-china

2
star
36

nodejs-webstreams-perf

JavaScript
2
star
37

cidao-bot

Discord bot just for fun
TypeScript
1
star
38

MinesweeperEngine

๐ŸŽฒEngine of the Minesweeper
Ruby
1
star
39

test-gh-pr-referral

Test fork referral
1
star
40

VHelper.site

HTML
1
star
41

nest-starter

Example of usage with absolute paths
TypeScript
1
star
42

tcp-netw

Simple client and server communication.
C
1
star
43

VHelper

Screen Reader more optmized
C++
1
star
44

node-playground

๐ŸŽฎ Playing with Libuv and Node Core concepts
HTML
1
star
45

fastify-conditional-requests

Use ETag to Preconditional requests to solve concurrency requests.
TypeScript
1
star
46

portfolio

Vue
1
star
47

geek4geek.api

JavaScript
1
star
48

PyCam

๐Ÿ“ท Face recognition based on LBPH Algorithm and Filters in real-time image.
Python
1
star
49

vpn-router-cpp

Example of router by sockets
C
1
star
50

fastify-fp-types

Reproduction code
TypeScript
1
star
51

using-bad-action

1
star
52

mit-6172

Some codes from lectures at MIT 6172
C
1
star
53

open-apm-sdk-node

Open APM SDK for NodeJS
JavaScript
1
star
54

benchmark-pr-example

Lab repository
1
star
55

nodejs-benchmark-coverage

JavaScript
1
star
56

nodejs-bench-alternatives

Compare packages
JavaScript
1
star