Debian 10 Buster DLA-3137-1 Critical Node.js Command Injection Threat

CVE-2021-22930, CVE-2021-22940

Use after free attack where an attacker might be able to exploit
the memory corruption, to change process behavior.

CVE-2021-22939

If the Node.js https API was used incorrectly and "undefined" was
in passed for the "rejectUnauthorized" parameter, no error was
returned and connections to servers with an expired certificate
would have been accepted.

CVE-2022-21824

Due to the formatting logic of the "console.table()" function it
was not safe to allow user controlled input to be passed to the
"properties" parameter while simultaneously passing a plain object
with at least one property as the first parameter, which could be
"__proto__".

CVE-2022-32212

OS Command Injection vulnerability due to an insufficient
IsAllowedHost check that can easily be bypassed because
IsIPAddress does not properly check if an IP address is invalid
before making DBS requests allowing rebinding attacks.