episode-header-image

Jul 2021

11m 14s

NodeJS July 2021 Security Releases

About this episode

In today's show I go through the NodeJS Security Releases for the month of July 2021, lots of interesting vulnerabilities to discuss.

0:00 Intro

1:00 CVE-2021-22918 - libuv DNS Out of bounds Crash

3:40 CVE-2021-22921 - Node Windows installer Local Privilege Escalation

7:30 CVE-2021-27290 - ssri Regular Expression Denial of Service (ReDoS)

Resources

https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/

https://hackerone.com/reports/1211160

https://snyk.io/vuln/SNYK-JS-SSRI-1085630

Up next

Engineers will be out of the 'Loops'

I discuss loops engineering and how it will numb creative thinking and critical system design for engineers.

SQL was a mistake

I like SQL but the standard should have included ways to hint instead of the abstraction of "let me do it for you"

Caching is a cop-out

In this episode I explore why you should take some time to examine the operation you are caching before doing so. And why caching is a cop-out

Recommended Episodes

811: NodeJS Evolves

In this episode of Syntax, Wes and Scott talk about the latest features in Node.js, including native support for TypeScript, .env parsing, a built-in test runner, watch mode, SQLite integration, glob support, and top-level await. They also discuss some wishlist items, and experim ... Show More

PP021: Critical Vulnerabilities, AI-Assisted Scams, Compromised VPNs, and More Security News

It’s an all-news episode for this week’s Packet Protector podcast. We cover critical vulnerabilities in the MOVEit file transfer software and in thousands of ASUS routers, and a remote code execution vulnerability in a Windows wireless driver that you really should patch. We disc ... Show More

JavaScript Vulnerabilities with Tim Kadlec - The State of the Web

<p><span style="font-weight: 400;">(Originally aired on YouTube on May 30, 2018)</span></p> <p><span style="font-weight: 400;">Rick and Tim talk about how insecure much of the web really is, the various vulnerabilities in web security that can leave you open to attack, the challe ... Show More

The state of Node security (JS Party #23)

Suz Hinton, Christopher Hiller, and Jerod Santo talk with Adam Baldwin about his company being acquired by NPM, the security of Node, best practices, and more.