Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.
Static site suprimacy week.
JavaScript should never have been used that way to begin with.
JavaScript should never have been used
that wayto begin with.
Node has literally always been like this. It’s just a risk you accept when you choose to use it.
Nothing wrong with static sites!
but what about vulnerabilities in the web server? 😱
Just staple your website to a telephone pole
That would be the best result if everyone just went back to static sites.
Has pure HTML (no css, no javascript) ever had a serious security issue? On the server side obviously not (outside of the apache/nginx/etc. having application bugs), but even on the client side has there ever been an exploit?
I think there’s been one or two image decompression exploits over the years, so a site with a malicious file could end up running code on your system. I remember this being an issue with Minecraft clients and player skins at one point, but I can’t remember any specific times this happened in browsers tho.
I build custom websites that run primarily on css and html. Light JS for applications, and some simple PHP to tie everything together. I am unaware of any flaw or exploit that would disable my sites. I don’t recall any html vulnerabilities. Unless there’s e-commerce involved, that’s nothing I can think of that would be exploitable on either side for html or css. These are both hard coded into the browser so I’m not even sure what an exploit would accomplish other than changing values on the client side. But it’s been a long week…
Edit Looks like zarobi below remembered some exploits. Totally forgot about iframes and the weird image data exploits.
My man
That’s why my site will always be html monke.
Why are people mad? These issues existed and now they don’t. It’s not like the researchers created them
“If you don’t test for them, the numbers will go down” - President Trump on COVID-19.
How many apocalyptic security flaws can fit into a week?
I never noticed how long the sales guy’s hand is
“This bad boy can hold so many limes”
NSA backdoors
While the world reels from websites being taken down before critical PHP patches were released
Is it just me or did anyone else not even notice outside of articles lol… It was all resolved by the time I got off work.
It’s not resolved until everyone installs the patch. And there in lies the problem.
An important point yes and I do understand that, but the major players like Steam were updated and done before I knew it. I have no doubt this could come back to bite companies/people lagging behind over the next few years, but the impact to me from websites being taken down was 0, which was my point.
The only site I knew was affected was the next cloud homepage which I checked for updates if they already had a patched version for there docker containers. So I thought it quite funny that the site I visited to see if they had fixed it was also affected.
some sites in my region that people use went down temporarily, but i never used them.
The sky is falling… Except it isn’t. Standard nonsense self advertising. And yes, vulnerabilities exist and canleasd to badness. We agree. It has always been so.
Well, I mean, the AI advances have moved the mean time to exploit between a zero day being announced, and it actively being exploited en masse, from about 3 weeks in 2018, to about -1 day in 2026. So, things have changed a bit.
To be fair, this is literally the only thing AI is being sold as useful for that actually works.
I mean I’ll update my Node version, but until someone actually finds an exploit chain on a real system (instead of a vibecoded PoC) I don’t see any reason to panic. All these "could"s and "would"s in the article suggest that it’s kind of a nothing-burger imo
Who cares if it’s vibecoded? The exploit is the exploit.
Uhm. There’s a release called Node2Shell, linked in the article.
I’ll bet this is another “AI found a known vulnerability so people are making a big deal about it” like the PHP one.
I’m with you on the first part but I believe that 2/4 PHP exploits have been observed in the wild.
If it’s really a PoC, it would actually execute and therefore exploit something (otherwise it wouldn’t be a proof). In which case it doesn’t matter if it’s vibecoded or not. If you succeed in breaching a system with it, there’s an issue that needs to be fixed.
Yup. Once the PoC has been documented, you gotta patch. Now if you want them to stop vibe coding to find complex PoCs that a human may have never found, it’s a risk.
That’s exactly the thing. They call themselves PoCs, but most of the time the exploit chain that they “prove” relies on some extremely unrealistic condition, like the intruder already having elevated privileges. Or it’s just completely made up and the PoC only “works” because the AI changed the source code. It’s incredibly unreliable.
I think you’re speaking in general and not about this specific case. This is an unauthenticated remote code exploit. All that needs to happen is your website accepts a brotli from a client or from an external api and tries to read it.
This is a bad one. Broke my no deploys on Friday rule for it.
I see. Yeah then it’s crap.
Pure sensationalism. We should celebrate new tools helping us to make oir software safer … but, nah, the end is nigh … start digging, and buy non-perishables, bullets, and lube
This what you get for running JS as your back end!
This always struck me as a rather silly idea, to be honest.
Now we’ve come full circle. I have a vendor who is insisting that I use node.js and pull their code from their NPM repository from the same… For frontend code. Just, have the entire contents of your (their) node_modules folder exposed to the public internet at all times. Isn’t this just Javascript with extra steps?
While it’s a bit opportunistic to blame JS in the backend in this case, I despise JS in the backend enough to happily join you.
Serves you well JS enthusiasts, your programming language is the only one that I despise more the more I learn about it. :P
every time the sun rises, shines and sets; a million new node vulnerabilities are discovered
be careful, obviously, but don’t let it turn your entire nervous system into pure crystallized cortisol
you can deal with it on Monday
It is kinda funny to hear the manager say “Brotli” as if it were some cursed ancient artefact tho. I’m down to not tell the managers that this is overblown bs. Let them think that we saved the system from certain doom.
If only it were that easy, if you do that, the managers will be grateful certainly, but they will also endlessly demand more proof and validation that the system is now completely safe from certain doom until they feel comfortable, which is never. In a lot of cases it’s simply easier to convince them that the system was never vulnerable to certain doom in the first place, because you were of course already 5 steps ahead of this even in the planning stages, and for some reason they have an easier time accepting that, as long as they still have every reason to believe you are a brilliant tech god who would never personally fall victim to such a common vulnerability. I suppose it’s really less about the reality of the situation and more about what kind of corporate image you are cultivating and maintaining for yourself.
Imagine working in IT security. How bad a time are you having right now? Are we expecting things to become better or worse the next few months?
When you’ve been at battle stations for 12 years it just feels like another week.
Open a ticket and add it to the list.
Honestly let it burn.
I am… well sorta. My team has to deal with the cleanup and repercussions at least. Let’s just say this week was not fun. At all.
In addition to the eMudhra certs and the php issue, there were also issues with python, Oracle, Java, and node.js. The certs and php were definitely the highest profile. They shut down incoming traffic to university web servers for the php one. The certs would have been more of a problem if we had extremely short expiration times
Am in IT. These last few days were pretty annoying. 3 mandatory meetings a day. Scrambling to find the right person for our 3rd party stacks.
The fix was pretty easy once we had it. Just annoyed that this is going to only get worse.
Not as bad as heart bleed
No. Put the Genie back in the bottle. We need air traffic control for this shit. Or we just gave to shut down all the PHP and NodeJs servers. (This is sarcasm…mostly.)
These vulnerabilities are only news stories because developers don’t develop strategies to patch their products rapidly enough.
