Node.js has just released fixes for 10 security vulnerabilities that could put node-powered applications at risk and is urging everyone to update their systems.
You must log in or register to comment.
12 daysHas pure HTML (no css, no javascript) ever had a serious security issue? On the server side obviously not (outside of the apache/nginx/etc. having application bugs), but even on the client side has there ever been an exploit?
- AlphaOmega@lemmy.worldEnglish12 days
I build custom websites that run primarily on css and html. Light JS for applications, and some simple PHP to tie everything together. I am unaware of any flaw or exploit that would disable my sites. I don’t recall any html vulnerabilities. Unless there’s e-commerce involved, that’s nothing I can think of that would be exploitable on either side for html or css. These are both hard coded into the browser so I’m not even sure what an exploit would accomplish other than changing values on the client side. But it’s been a long week…
Edit Looks like zarobi below remembered some exploits. Totally forgot about iframes and the weird image data exploits.
- Zarobi@aussie.zoneEnglish12 days
Yeah but if it’s just pure HTML you got an ugly-ass website that’s annoying to use. There’s been many JavaScript and css vulnerabilities over the years of course. But yes there was and still is plain HTML issues
Client side:
- I vaguely remember some base64 embedded encoding malware.
- I do believe there was some issues with early HTML, if you had malformed tags, that could bypass checks and balances.
- Svg, Images, audio, fonts, and video can definitely contain malware. Before you say fonts are a css thing, <font> was a real tag
- IFrames were the worst:
- They had too much power in the past and could hijack the page and browser.
- There was no content security policy back then so they could inject JavaScript into the main page as well.
- Also they can cover the whole screen and present a normal login screen, and hijack all inputs going through it. Think of it like you’re on dodgey-site.com and it has a full page IFrame to bank.com. This was a common hack back in the day which inspired an entire http header to help prevent this.
- Anchor tags can link to something dodgey of course.
- Embedded PDFs were a huge issue.
- ActiveX and other web applets was just fucked. They were so bad they caused malware constantly. This is where unsolicited toolbars came from.
- Adobe Flash had many many vulnerabilities over the years.
- Canvas bugs are still a thing today.
Server side, you could execute SQL injection and path traversal just via URL before the page even loads. Malware and other issues can be embedded in text inputs. HTML can be uploaded to the server and in some cases replayed on the page affecting other users (comment sections were infamous for this).
So yeah; a plain HTML page with no JavaScript or css isn’t necessarily safe
- Zarobi@aussie.zoneEnglish11 days
Oh yeah, everyone loves black text on white background, with each div placed sequentially in a vertical stack
:)really gives it that vintage mid 90’s dial up internet “the website failed to load CSS” lookThere’s nothing wrong with CSS. Arguably it’s been overcomplicated way beyond it’s original scope, but it works as designed to make your sites look good
- python@lemmy.worldEnglish12 days
I mean I’ll update my Node version, but until someone actually finds an exploit chain on a real system (instead of a vibecoded PoC) I don’t see any reason to panic. All these "could"s and "would"s in the article suggest that it’s kind of a nothing-burger imo
- [deleted]@piefed.worldEnglish12 days
I’ll bet this is another “AI found a known vulnerability so people are making a big deal about it” like the PHP one.
Pure sensationalism. We should celebrate new tools helping us to make oir software safer … but, nah, the end is nigh … start digging, and buy non-perishables, bullets, and lube
- aksdb@lemmy.worldEnglish12 days
If it’s really a PoC, it would actually execute and therefore exploit something (otherwise it wouldn’t be a proof). In which case it doesn’t matter if it’s vibecoded or not. If you succeed in breaching a system with it, there’s an issue that needs to be fixed.
- heartSagan5@lemmy.zipEnglish9 days
Yup. Once the PoC has been documented, you gotta patch. Now if you want them to stop vibe coding to find complex PoCs that a human may have never found, it’s a risk.
- python@lemmy.worldEnglish12 days
That’s exactly the thing. They call themselves PoCs, but most of the time the exploit chain that they “prove” relies on some extremely unrealistic condition, like the intruder already having elevated privileges. Or it’s just completely made up and the PoC only “works” because the AI changed the source code. It’s incredibly unreliable.
- 11 days
I think you’re speaking in general and not about this specific case. This is an unauthenticated remote code exploit. All that needs to happen is your website accepts a brotli from a client or from an external api and tries to read it.
This is a bad one. Broke my no deploys on Friday rule for it.
- 12 days
This always struck me as a rather silly idea, to be honest.
Now we’ve come full circle. I have a vendor who is insisting that I use node.js and pull their code from their NPM repository from the same… For frontend code. Just, have the entire contents of your (their) node_modules folder exposed to the public internet at all times. Isn’t this just Javascript with extra steps?
- 11 days
While it’s a bit opportunistic to blame JS in the backend in this case, I despise JS in the backend enough to happily join you.
Serves you well JS enthusiasts, your programming language is the only one that I despise more the more I learn about it. :P
every time the sun rises, shines and sets; a million new node vulnerabilities are discovered
be careful, obviously, but don’t let it turn your entire nervous system into pure crystallized cortisol
you can deal with it on Monday
- python@lemmy.worldEnglish12 days
It is kinda funny to hear the manager say “Brotli” as if it were some cursed ancient artefact tho. I’m down to not tell the managers that this is overblown bs. Let them think that we saved the system from certain doom.
- cecilkorik@piefed.caEnglish11 days
If only it were that easy, if you do that, the managers will be grateful certainly, but they will also endlessly demand more proof and validation that the system is now completely safe from certain doom until they feel comfortable, which is never. In a lot of cases it’s simply easier to convince them that the system was never vulnerable to certain doom in the first place, because you were of course already 5 steps ahead of this even in the planning stages, and for some reason they have an easier time accepting that, as long as they still have every reason to believe you are a brilliant tech god who would never personally fall victim to such a common vulnerability. I suppose it’s really less about the reality of the situation and more about what kind of corporate image you are cultivating and maintaining for yourself.
- magnolia_mayhem@lemmy.worldEnglish11 days
Why are people mad? These issues existed and now they don’t. It’s not like the researchers created them
- heartSagan5@lemmy.zipEnglish9 days
“If you don’t test for them, the numbers will go down” - President Trump on COVID-19.
- canttakeitwithyou@lemmy.zipEnglish11 days
The sky is falling… Except it isn’t. Standard nonsense self advertising. And yes, vulnerabilities exist and canleasd to badness. We agree. It has always been so.
- wampus@lemmy.caEnglish11 days
Well, I mean, the AI advances have moved the mean time to exploit between a zero day being announced, and it actively being exploited en masse, from about 3 weeks in 2018, to about -1 day in 2026. So, things have changed a bit.
To be fair, this is literally the only thing AI is being sold as useful for that actually works.
- darthsundhaft@piefed.socialEnglish12 days
Yeah, so here’s the thing. People keep trying to bash on PHP as if anything software isn’t manmade and comes baked with flaws that can be exploited. It’s the single reason why cybersecurity products are never going to stop being used because no matter what, it’s based on something somebody made.
It’s going to be flawed or be exploitable by some means. Yesterday it was Log4J, now it’s PHP, tomorrow it will be something else. It will never end. Companies deliberately also use this to force you to upgrade because they’ve abandoned “legacy” products that still work but which they no longer choose to maintain because they want more money and need to stifle you for it somehow.
- neclimdul@lemmy.worldEnglish11 days
rihht? opencloud posted a really tacky “nextcloud is dealing with this. checkout open cloud. written in go.”
dude… do we need to drop a link to the golang cves? they had a critical bug this year.
ruby? critical regex rce this week.
nodejs? same.
php made the news because of the embargo break making it go viral and everyone loving to hate on php. But people in glass houses should be careful throwing stones.
- treverflume@lemmy.mlEnglish11 days
How’s Rust holding these days I wonder? Always wished I had learned it when it first came out ha.
- neclimdul@lemmy.worldEnglish11 days
apparently i was wrong… https://github.com/rust-lang/rust/issues/164250
haven’t watched it yet but apparently this is a good explanation https://www.youtube.com/watch?v=4iAi5exNHv8
- neclimdul@lemmy.worldEnglish11 days
Rust itself doesnt get mant CVEs and its been quiet so thats nice.
its worth noting its a bit different than languages I listed and lower-level. Those languages are also runtimes that provide a large set of features that run with your code.
That means while you could write websites in Rust, reall it is what you might consider writing PHP in if you started in 2026 not an alternative. Its more closely like MUSL(did get a recent big security release 🙄) or glibc.
- Taleya@aussie.zoneEnglish10 days
I run a la. Not even a full lamp. Its just a slack box with base apache html.
For years i’ve been mocked. But that bitch has never been compromised and it’s damned near impossible. Who’s laughing now.
- 12 days
as an aside, i think the title is too sensationalist? click-baity?
- 12 days
No. Put the Genie back in the bottle. We need air traffic control for this shit. Or we just have to shut down all the PHP and NodeJs servers. (This is sarcasm…mostly.)
- SaharaMaleikuhm@feddit.orgEnglish12 days
Imagine working in IT security. How bad a time are you having right now? Are we expecting things to become better or worse the next few months?
- Agent641@lemmy.worldEnglish12 days
When you’ve been at battle stations for 12 years it just feels like another week.
Open a ticket and add it to the list.
