Every CVE Search/ Get API key

CVE-2020-8252

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js...

7.8 HighFix available

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.71%Down 1.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Record
CVE-2020-8252
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-120
Updated
2026-11-02
CVE List No score

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Record
CVE-2020-8252
Weakness
CWE-120
Updated
2026-11-02
EUVDEUVD-2020-29122 No score

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Record
EUVD-2020-29122
Updated
2026-11-02
GitHub AdvisoriesGHSA-c5r6-cm8r-wgh9 7.8

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js...

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Record
GHSA-c5r6-cm8r-wgh9
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-120
Updated
2026-11-02
OSVALPINE-CVE-2020-8252 7.8

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Record
ALPINE-CVE-2020-8252
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2020-8252 7.8

CVE-2020-8252 does not affect BellSoft software

Record
BELL-CVE-2020-8252
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 23 moreShow less
OSV 7.8

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Record
CVE-2020-8252
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-8252 7.8

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Record
DEBIAN-CVE-2020-8252
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:4272 7.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2020:4272
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:4903 7.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2020:4903
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2020:5086 7.8

Red Hat Security Advisory: rh-nodejs12-nodejs security update

Record
RHSA-2020:5086
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:0521 8.1

Red Hat Security Advisory: rh-nodejs10-nodejs security update

Record
RHSA-2021:0521
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:0548 8.1

Red Hat Security Advisory: nodejs:10 security update

Record
RHSA-2021:0548
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2020:4272 7.8

Moderate: nodejs:12 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.18.4).

Security Fix(es):

  • nodejs-dot-prop: prototype pollution (CVE-2020-8116)

  • nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

  • npm: Sensitive information exposure through logs (CVE-2020-15095)

  • libuv: buffer overflow in realpath (CVE-2020-8252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • The nodejs:12/development module is not installable (BZ#1883966)
Record
RLSA-2020:4272
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:0548 8.1

Moderate: nodejs:10 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.23.1).

Security Fix(es):

  • libuv: buffer overflow in realpath (CVE-2020-8252)

  • nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

  • nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

  • nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-dot-prop: prototype pollution (CVE-2020-8116)

  • nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

  • npm: sensitive information exposure through logs (CVE-2020-15095)

  • nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

  • nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

  • nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:0548
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-8252 7.8

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Record
UBUNTU-CVE-2020-8252
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2020:4272 No score

Moderate: nodejs:12 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.18.4).

Security Fix(es):

  • nodejs-dot-prop: prototype pollution (CVE-2020-8116)

  • nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)

  • npm: Sensitive information exposure through logs (CVE-2020-15095)

  • libuv: buffer overflow in realpath (CVE-2020-8252)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • The nodejs:12/development module is not installable (BZ#1883966)
Record
ALSA-2020:4272
Updated
2026-11-02
OSVALSA-2021:0548 No score

Moderate: nodejs:10 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.23.1).

Security Fix(es):

  • libuv: buffer overflow in realpath (CVE-2020-8252)

  • nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)

  • nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)

  • nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-dot-prop: prototype pollution (CVE-2020-8116)

  • nodejs: use-after-free in the TLS implementation (CVE-2020-8265)

  • npm: sensitive information exposure through logs (CVE-2020-15095)

  • nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)

  • nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)

  • nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2021:0548
Updated
2026-11-02
OSVBIT-node-2020-8252 No score

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Record
BIT-node-2020-8252
Updated
2026-11-02
OSVBIT-node-min-2020-8252 No score

The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.

Record
BIT-node-min-2020-8252
Updated
2026-11-02
OSVMGASA-2020-0372 No score

Updated nodejs packages fix security vulnerabilities

The nodejs package has been updated to the latest version in the 10.x branch, which is 10.22.1 at this time. It fixes several security issues and other bugs. See the upstream changelog and advisories for details.

Record
MGASA-2020-0372
Updated
2026-11-02
OSVMGASA-2020-0398 No score

Updated libuv packages a fix security vulnerability

The implementation of realpath in libuv before 1.39 incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes (CVE-2020-8252).

Record
MGASA-2020-0398
Updated
2026-11-02
OSVopenSUSE-SU-2020:1616-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • nodejs12 was updated to 12.18.4 LTS:
    • CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).
    • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
    • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
  • Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2020:1616-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1660-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

  • nodejs10 was updated to 10.22.1 LTS:
    • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
    • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
  • Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1660-1
Updated
2026-11-02
OSVSUSE-SU-2020:2812-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • nodejs12 was updated to 12.18.4 LTS:
    • CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).
    • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
    • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
  • Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)
Record
SUSE-SU-2020:2812-1
Updated
2026-11-02
OSVSUSE-SU-2020:2813-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • nodejs12 was updated to 12.18.4 LTS:
    • CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).
    • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
    • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
  • Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)
Record
SUSE-SU-2020:2813-1
Updated
2026-11-02
OSVSUSE-SU-2020:2823-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

  • nodejs10 was updated to 10.22.1 LTS:
    • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
    • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
  • Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)
Record
SUSE-SU-2020:2823-1
Updated
2026-11-02
OSVSUSE-SU-2020:2829-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

  • nodejs10 was updated to 10.22.1 LTS:
    • CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).
    • CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).
  • Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation on Aarch64 with gcc10 (bsc#1172686)
Record
SUSE-SU-2020:2829-1
Updated
2026-11-02
OSVUSN-4548-1 No score

libuv1 vulnerability

It was discovered that libuv incorrectly handled certain paths. An attacker could possibly use this issue to cause a crash or execute arbitrary code.

Record
USN-4548-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libuv
Alpine:v3.12
 before 1.38.1-r0
1.38.1-r0
libuv
Alpine:v3.13
 before 1.39.0-r0
1.39.0-r0
libuv
Alpine:v3.14
 before 1.39.0-r0
1.39.0-r0
libuv
Alpine:v3.15
 before 1.39.0-r0
1.39.0-r0
libuv
Alpine:v3.16
 before 1.39.0-r0
1.39.0-r0
libuv
Alpine:v3.17
 before 1.39.0-r0
1.39.0-r0
libuv
Alpine:v3.18
 before 1.39.0-r0
1.39.0-r0
libuv
Alpine:v3.19
 before 1.39.0-r0
1.39.0-r0
libuv
Alpine:v3.20
 before 1.39.0-r0
1.39.0-r0
libuv
Alpine:v3.21
 before 1.39.0-r0
1.39.0-r0
Show 88 moreShow less
Affected packages
PackageAffectedFixed
libuv
Alpine:v3.22
 before 1.39.0-r0
1.39.0-r0
libuv
Alpine:v3.23
 before 1.39.0-r0
1.39.0-r0
libuv
Alpine:v3.24
 before 1.39.0-r0
1.39.0-r0
nodejs
Alpine:v3.11
 before 12.20.1-r0
12.20.1-r0
nodejs
Alpine:v3.12
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.13
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.14
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.15
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.16
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.17
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.18
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.19
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.20
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.21
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.22
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.23
 before 12.18.4-r0
12.18.4-r0
nodejs
Alpine:v3.24
 before 12.18.4-r0
12.18.4-r0
nodejs-nodemon
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.18.3-1.module_el8.3.0+2023+d2377ea3
1.18.3-1.module_el8.3.0+2023+d2377ea3
nodejs-nodemon
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.18.3-1.module_el8.3.0+2047+b07ac28e
1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 4 CVEs
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 4 CVEs
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 4 CVEs
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
nodejs-nodemon
AlmaLinux:8
From an advisory covering 10 CVEs
 before 1.18.3-1.module_el8.3.0+2023+d2377ea3
1.18.3-1.module_el8.3.0+2023+d2377ea3
nodejs-nodemon
AlmaLinux:8
From an advisory covering 10 CVEs
 before 1.18.3-1.module_el8.3.0+2047+b07ac28e
1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 10 CVEs
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 10 CVEs
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 10 CVEs
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
node
Bitnami
 10.0.0 up to 10.22.1, 12.0.0 up to 12.18.4, 14.0.0 up to 14.9.0
10.22.112.18.414.9.0
node-min
Bitnami
 10.0.0 up to 10.22.1, 12.0.0 up to 12.18.4, 14.0.0 up to 14.9.0
10.22.112.18.414.9.0
libuv1
Debian:12
 before 1.39.0-1
1.39.0-1
libuv1
Debian:13
 before 1.39.0-1
1.39.0-1
libuv1
Debian:14
 before 1.39.0-1
1.39.0-1
libuv
Mageia:7
From an advisory covering 16 CVEs
 before 1.34.2-1.mga7
1.34.2-1.mga7
nodejs
Mageia:7
From an advisory covering 16 CVEs
 before 10.22.1-9.mga7
10.22.1-9.mga7
libuv
Mageia:7
 before 1.34.2-1.1.mga7
1.34.2-1.1.mga7
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.2.0+8361+192e434e
1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.2.0+8361+192e434e
1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.2.0+8361+192e434e
1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.2.0+8361+192e434e
1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.2.0+8361+192e434e
1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.2.0+8361+192e434e
1:12.18.4-2.module+el8.2.0+8361+192e434e
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e
1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e
nodejs
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.1.0+8360+14141500
1:12.18.4-2.module+el8.1.0+8360+14141500
nodejs-debuginfo
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.1.0+8360+14141500
1:12.18.4-2.module+el8.1.0+8360+14141500
nodejs-debugsource
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.1.0+8360+14141500
1:12.18.4-2.module+el8.1.0+8360+14141500
nodejs-devel
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.1.0+8360+14141500
1:12.18.4-2.module+el8.1.0+8360+14141500
nodejs-docs
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.1.0+8360+14141500
1:12.18.4-2.module+el8.1.0+8360+14141500
nodejs-full-i18n
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:12.18.4-2.module+el8.1.0+8360+14141500
1:12.18.4-2.module+el8.1.0+8360+14141500
nodejs-nodemon
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 4 CVEs
 before 1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500
1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.18.4-3.el7
0:12.18.4-3.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.18.4-3.el7
0:12.18.4-3.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.18.4-3.el7
0:12.18.4-3.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.18.4-3.el7
0:12.18.4-3.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:6.14.6-12.18.4.3.el7
0:6.14.6-12.18.4.3.el7
rh-nodejs10-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:10.23.1-2.el7
0:10.23.1-2.el7
rh-nodejs10-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:10.23.1-2.el7
0:10.23.1-2.el7
rh-nodejs10-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:10.23.1-2.el7
0:10.23.1-2.el7
rh-nodejs10-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:10.23.1-2.el7
0:10.23.1-2.el7
rh-nodejs10-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 10 CVEs
 before 0:6.14.10-10.23.1.2.el7
0:6.14.10-10.23.1.2.el7
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:10.23.1-1.module+el8.3.0+9502+012d8a97
1:10.23.1-1.module+el8.3.0+9502+012d8a97
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:10.23.1-1.module+el8.3.0+9502+012d8a97
1:10.23.1-1.module+el8.3.0+9502+012d8a97
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:10.23.1-1.module+el8.3.0+9502+012d8a97
1:10.23.1-1.module+el8.3.0+9502+012d8a97
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:10.23.1-1.module+el8.3.0+9502+012d8a97
1:10.23.1-1.module+el8.3.0+9502+012d8a97
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:10.23.1-1.module+el8.3.0+9502+012d8a97
1:10.23.1-1.module+el8.3.0+9502+012d8a97
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:10.23.1-1.module+el8.3.0+9502+012d8a97
1:10.23.1-1.module+el8.3.0+9502+012d8a97
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 0:1.18.3-1.module+el8+2632+6c5111ed
0:1.18.3-1.module+el8+2632+6c5111ed
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 0:17-3.module+el8+2873+aa7dfd9a
0:17-3.module+el8+2873+aa7dfd9a
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 10 CVEs
 before 1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97
1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:1.18.3-1.module+el8.3.0+101+f84c7154
0:1.18.3-1.module+el8.3.0+101+f84c7154
nodejs-packaging
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
nodejs-nodemon
Rocky Linux:8
From an advisory covering 10 CVEs
 before 0:1.18.3-1.module+el8.3.0+101+f84c7154
0:1.18.3-1.module+el8.3.0+101+f84c7154
nodejs-packaging
Rocky Linux:8
From an advisory covering 10 CVEs
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 3 CVEs
 before 12.18.4-1.20.1
12.18.4-1.20.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 3 CVEs
 before 12.18.4-4.6.1
12.18.4-4.6.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 2 CVEs
 before 10.22.1-1.30.1
10.22.1-1.30.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP1
From an advisory covering 2 CVEs
 before 10.22.1-1.27.1
10.22.1-1.27.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 2 CVEs
 before 10.22.1-1.27.1
10.22.1-1.27.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 2 CVEs
 before 10.22.1-1.27.1
10.22.1-1.27.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 2 CVEs
 before 10.22.1-1.27.1
10.22.1-1.27.1
nodejs10
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 2 CVEs
 before 10.22.1-1.27.1
10.22.1-1.27.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 2 CVEs
 before 10.22.1-1.27.1
10.22.1-1.27.1
libuv1
Ubuntu:20.04:LTS
 before 1.34.2-1ubuntu1.1, plus listed versions
1.30.1-11.33.1-21.33.1-2ubuntu21.33.1-3ubuntu11.34.2-1ubuntu1
1.34.2-1ubuntu1.1
nodejs12
openSUSE:Leap 15.2
From an advisory covering 3 CVEs
 before 12.18.4-lp152.3.6.1
12.18.4-lp152.3.6.1
nodejs10
openSUSE:Leap 15.2
From an advisory covering 2 CVEs
 before 10.22.1-lp152.2.6.1
10.22.1-lp152.2.6.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-8252 is a high vulnerability (CVSS 7.8) in Nodejs Node, published September 18, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in libuv 1.38.1-r0.

References

Show 115 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open