TI-2020-06291 CVE-2020-7774 · GHSA-c4w7-xm78-47vh
Prototype pollution in y18n
Priority HIGH 79
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
RHSA-2021:0548
nodejs:10 security update
Released 2021-02-16 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64::nodejs:10, nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le::nodejs:10, nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x::nodejs:10 +19
Fixes 10 records
TI-2020-06304 CVE-2020-7788 · GHSA-qqgx-2p2h-9c37
Prototype pollution in ini
Priority MEDIUM 55
This affects the package ini before 1.3.6.
TI-2020-06683 CVE-2020-8265 · GHSA-879w-9vpf-9pw9
Use after free in NodeJS Node
Priority MEDIUM 47
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation.
TI-2020-06704 CVE-2020-8287 · GHSA-f33f-hhx9-6j4m
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header…
Priority MEDIUM 45
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields).
TI-2020-06272 CVE-2020-7754 · GHSA-pw54-mh39-w3hc
Regular expression denial of service (ReDoS) in npm-user-validate
Priority LOW 39
This affects the package npm-user-validate before 1.0.1.
TI-2020-06534 CVE-2020-8116 · GHSA-ff7x-qrg7-qggm
Prototype pollution in dot-prop
Priority LOW 38
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
TI-2020-06670 CVE-2020-8252 · GHSA-c5r6-cm8r-wgh9
Buffer overflow in NodeJS Node
Priority LOW 35
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
TI-2020-12113 CVE-2020-15366 · GHSA-v88g-cgmw-v5xw
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator)…
Priority LOW 30
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2.
TI-2020-06130 CVE-2020-7608 · GHSA-p9pc-299p-vxgp
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
Priority LOW 25
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
TI-2020-11870 CVE-2020-15095 · GHSA-93f3-23rq-pjfp
Sensitive information exposure through logs in npm cli
Priority LOW 21
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files.