topic Support newer versions Node.JS in Reporting Service & Alerting

Support newer versions Node.JS

nvankorlaar — Wed, 29 Jan 2025 15:57:23 GMT

Hi,

When will Qlik Alerting support newer versions of Node.JS?

This is due to the following vulnerabilities, which are marked as high risk by the Dutch Cyber Security Center:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36067
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29017
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29199
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30547

Or can someone from Qlik confirm if this is also an risk for node.js used by Qlik Alerting.

Re: Support newer versions Node.JS

Lucas_Gatling — Mon, 24 Apr 2023 11:08:37 GMT

What version of Node.JS do you have installed? Qlik Alerting Oct. 21 supports versions Versions 10.x to 16.18 of Node.JS

https://help.qlik.com/en-US/alerting/October2021/Content/QlikAlerting/installation-prerequisites.htm

Re: Support newer versions Node.JS

nvankorlaar — Mon, 24 Apr 2023 14:07:53 GMT

We always install the latest version, so in this case 16.18, according to what i can see this has VM2 version 3.9.9 which has the sandbox breakout vulnerability as posted before. VM2 needs to be at least version 3.9.11 for this to be resolved.