Every CVE Search/ Get API key

CVE-2021-23362

Regular Expression Denial of Service (ReDoS)

5.3 MediumFix available

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

3.61%Up 2.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.3

Regular Expression Denial of Service (ReDoS)

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Record
CVE-2021-23362
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
Updated
2026-11-02
EUVDEUVD-2021-0928 5.3

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Record
EUVD-2021-0928
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
Updated
2026-11-03
GitHub AdvisoriesGHSA-43f8-2h32-f4cj 5.3

Regular Expression Denial of Service in hosted-git-info

The npm package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity

Record
GHSA-43f8-2h32-f4cj
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400
Updated
2026-11-02
NVD 5.3

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Record
CVE-2021-23362
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-1333
Updated
2026-11-02
OSVAZL-44058 5.3

CVE-2021-23362 affecting package js-jquery 3.5.0-4

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Record
AZL-44058
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-05
OSV 5.3

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Record
CVE-2021-23362
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 34 moreShow less
OSVDEBIAN-CVE-2021-23362 5.3

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Record
DEBIAN-CVE-2021-23362
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVGHSA-43f8-2h32-f4cj 5.3

Regular Expression Denial of Service in hosted-git-info

The npm package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity

Record
GHSA-43f8-2h32-f4cj
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-400
Updated
2026-11-02
OSVOESA-2021-1168 5.3

nodejs-hosted-git-info security update

Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab

Security Fix(es):

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.(CVE-2021-23362)

Record
OESA-2021-1168
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2021:2931 7.5

Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update

Record
RHSA-2021:2931
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:2932 7.5

Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

Record
RHSA-2021:2932
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:3073 7.5

Red Hat Security Advisory: nodejs:12 security, bug fix, and enhancement update

Record
RHSA-2021:3073
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:3074 7.5

Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Record
RHSA-2021:3074
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:3638 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2021:3638
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3639 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2021:3639
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:3073 7.5

Moderate: nodejs:12 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.22.3). (BZ#1978201)

Security Fix(es):

  • nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)

  • nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)

  • libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:3073
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2021:3074 7.5

Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.17.3). (BZ#1978203)

Security Fix(es):

  • nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)

  • nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)

  • libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:3074
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-23362 5.3

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Record
UBUNTU-CVE-2021-23362
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2021:3073 No score

Moderate: nodejs:12 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.22.3). (BZ#1978201)

Security Fix(es):

  • nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)

  • nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)

  • libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2021:3073
Updated
2026-11-02
OSVALSA-2021:3074 No score

Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.17.3). (BZ#1978203)

Security Fix(es):

  • nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)

  • nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)

  • libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2021:3074
Updated
2026-11-02
OSVCLSA-2026-1773015270 No score

TuxCare security update for hosted-git-info (1 CVE)

TuxCare rebuilt hosted-git-info to address 1 CVE. Fixed in 2.1.4-tuxcare.1.

Record
CLSA-2026-1773015270
Updated
2026-11-02
OSVCLSA-2026-1782954031 No score

TuxCare security update for hosted-git-info (1 CVE)

TuxCare rebuilt hosted-git-info to address 1 CVE. Fixed in 2.7.1-tuxcare.1.

Record
CLSA-2026-1782954031
Updated
2026-11-02
OSVMGASA-2021-0372 No score

Updated nodejs packages fix security vulnerabilities

This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('proto'); y18n.updateLocale({polluted: true}); console.log(polluted); // true (CVE-2020-7774).

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity (CVE-2021-23362).

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option (CVE-2021-27290).

Theses issues are fixed by upgrading nodejs packages to latest available LTS 14.17.3 version. See upstream releases notes for other included bugfixes.

Record
MGASA-2021-0372
Updated
2026-11-02
OSVopenSUSE-SU-2021:1059-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • update to 12.22.2:
  • CVE-2021-22918: Out of bounds read (bsc#1187973)
  • CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)
  • CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1059-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1060-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

Update nodejs14 to 14.17.2.

Including fixes for:

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1060-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1061-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

Update nodejs10 to 10.24.1.

Including fixes for

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • reduce memory footprint of test-worker-stdio (bsc#1183155)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:1061-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1113-1 No score

Security update for nodejs8

This update for nodejs8 fixes the following issues:

  • update to npm 6.14.13
  • CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)
  • CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977)
  • CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1113-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2327-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • update to 12.22.2:
  • CVE-2021-22918: Out of bounds read (bsc#1187973)
  • CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)
  • CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)
Record
openSUSE-SU-2021:2327-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2353-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

Update nodejs10 to 10.24.1.

Including fixes for

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • reduce memory footprint of test-worker-stdio (bsc#1183155)
Record
openSUSE-SU-2021:2353-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2354-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

Update nodejs14 to 14.17.2.

Including fixes for:

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
Record
openSUSE-SU-2021:2354-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2618-1 No score

Security update for nodejs8

This update for nodejs8 fixes the following issues:

  • update to npm 6.14.13
  • CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)
  • CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977)
  • CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450)
Record
openSUSE-SU-2021:2618-1
Updated
2026-11-02
OSVSUSE-SU-2021:2319-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

Update nodejs14 to 14.17.2.

Including fixes for:

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
Record
SUSE-SU-2021:2319-1
Updated
2026-11-02
OSVSUSE-SU-2021:2323-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

Update nodejs10 to 10.24.1.

Including fixes for

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
Record
SUSE-SU-2021:2323-1
Updated
2026-11-02
OSVSUSE-SU-2021:2326-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • update to 12.22.2:
  • CVE-2021-22918: Out of bounds read (bsc#1187973)
  • CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)
  • CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)
Record
SUSE-SU-2021:2326-1
Updated
2026-11-02
OSVSUSE-SU-2021:2327-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • update to 12.22.2:
  • CVE-2021-22918: Out of bounds read (bsc#1187973)
  • CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)
  • CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)
Record
SUSE-SU-2021:2327-1
Updated
2026-11-02
OSVSUSE-SU-2021:2353-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

Update nodejs10 to 10.24.1.

Including fixes for

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • reduce memory footprint of test-worker-stdio (bsc#1183155)
Record
SUSE-SU-2021:2353-1
Updated
2026-11-02
OSVSUSE-SU-2021:2354-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

Update nodejs14 to 14.17.2.

Including fixes for:

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
Record
SUSE-SU-2021:2354-1
Updated
2026-11-02
OSVSUSE-SU-2021:2618-1 No score

Security update for nodejs8

This update for nodejs8 fixes the following issues:

  • update to npm 6.14.13
  • CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)
  • CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977)
  • CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450)
Record
SUSE-SU-2021:2618-1
Updated
2026-11-02
OSVSUSE-SU-2021:2620-1 No score

Security update for nodejs8

This update for nodejs8 fixes the following issues:

  • update to npm 6.14.13
  • CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)
  • CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)
Record
SUSE-SU-2021:2620-1
Updated
2026-11-02
OSVUSN-5216-1 No score

node-hosted-git-info vulnerability

It was discovered that hosted-git-info incorrectly handled certain inputs. A remote attacker could use this to cause a denial of service.

Record
USN-5216-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
hosted-git-info
npm
 3.0.0 up to 3.0.8
3.0.8
hosted-git-info
npm
 before 2.8.9
2.8.9
nodejs-nodemon
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2.0.3-1.module_el8.4.0+2521+c668cc9f
2.0.3-1.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 3 CVEs
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
From an advisory covering 3 CVEs
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
From an advisory covering 3 CVEs
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
nodejs-packaging
AlmaLinux:8
From an advisory covering 3 CVEs
 before 23-3.module_el8.5.0+254+b4526b16
23-3.module_el8.5.0+254+b4526b16
nodejs-packaging
AlmaLinux:8
From an advisory covering 3 CVEs
 before 23-3.module_el8.4.0+2522+3bd42762
23-3.module_el8.4.0+2522+3bd42762
js-jquery
Azure Linux:3
 through 3.5.0-4 None known
hosted-git-info
TuxCare:npm
 2.7.1-tuxcare.0 up to 2.7.1-tuxcare.1, plus listed versions
2.7.1
2.7.1-tuxcare.1
Show 121 moreShow less
Affected packages
PackageAffectedFixed
node-hosted-git-info
Debian:12
 before 3.0.8-1
3.0.8-1
node-hosted-git-info
Debian:13
 before 3.0.8-1
3.0.8-1
node-hosted-git-info
Debian:14
 before 3.0.8-1
3.0.8-1
nodejs
Mageia:8
From an advisory covering 3 CVEs
 before 14.17.3-1.mga8
14.17.3-1.mga8
nodejs-hosted-git-info
openEuler:20.03-LTS-SP1
 before 2.1.4-2.oe1
2.1.4-2.oe1
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.22.2-1.el7
0:12.22.2-1.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.22.2-1.el7
0:12.22.2-1.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.22.2-1.el7
0:12.22.2-1.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.22.2-1.el7
0:12.22.2-1.el7
rh-nodejs12-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:2.0.3-2.el7
0:2.0.3-2.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:6.14.13-12.22.2.1.el7
0:6.14.13-12.22.2.1.el7
rh-nodejs14-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:14.17.2-1.el7
0:14.17.2-1.el7
rh-nodejs14-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:14.17.2-1.el7
0:14.17.2-1.el7
rh-nodejs14-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:14.17.2-1.el7
0:14.17.2-1.el7
rh-nodejs14-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:14.17.2-1.el7
0:14.17.2-1.el7
rh-nodejs14-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:2.0.3-2.el7
0:2.0.3-2.el7
rh-nodejs14-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:6.14.13-14.17.2.1.el7
0:6.14.13-14.17.2.1.el7
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:12.22.3-2.module+el8.4.0+11732+c668cc9f
1:12.22.3-2.module+el8.4.0+11732+c668cc9f
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:12.22.3-2.module+el8.4.0+11732+c668cc9f
1:12.22.3-2.module+el8.4.0+11732+c668cc9f
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:12.22.3-2.module+el8.4.0+11732+c668cc9f
1:12.22.3-2.module+el8.4.0+11732+c668cc9f
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:12.22.3-2.module+el8.4.0+11732+c668cc9f
1:12.22.3-2.module+el8.4.0+11732+c668cc9f
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:12.22.3-2.module+el8.4.0+11732+c668cc9f
1:12.22.3-2.module+el8.4.0+11732+c668cc9f
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:12.22.3-2.module+el8.4.0+11732+c668cc9f
1:12.22.3-2.module+el8.4.0+11732+c668cc9f
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:2.0.3-1.module+el8.4.0+11732+c668cc9f
0:2.0.3-1.module+el8.4.0+11732+c668cc9f
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:6.14.13-1.12.22.3.2.module+el8.4.0+11732+c668cc9f
1:6.14.13-1.12.22.3.2.module+el8.4.0+11732+c668cc9f
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:14.17.3-2.module+el8.4.0+11738+3bd42762
1:14.17.3-2.module+el8.4.0+11738+3bd42762
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:14.17.3-2.module+el8.4.0+11738+3bd42762
1:14.17.3-2.module+el8.4.0+11738+3bd42762
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:14.17.3-2.module+el8.4.0+11738+3bd42762
1:14.17.3-2.module+el8.4.0+11738+3bd42762
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:14.17.3-2.module+el8.4.0+11738+3bd42762
1:14.17.3-2.module+el8.4.0+11738+3bd42762
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:14.17.3-2.module+el8.4.0+11738+3bd42762
1:14.17.3-2.module+el8.4.0+11738+3bd42762
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:14.17.3-2.module+el8.4.0+11738+3bd42762
1:14.17.3-2.module+el8.4.0+11738+3bd42762
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:2.0.3-1.module+el8.3.0+6519+9f98ed83
0:2.0.3-1.module+el8.3.0+6519+9f98ed83
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:23-3.module+el8.3.0+6519+9f98ed83
0:23-3.module+el8.3.0+6519+9f98ed83
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:6.14.13-1.14.17.3.2.module+el8.4.0+11738+3bd42762
1:6.14.13-1.14.17.3.2.module+el8.4.0+11738+3bd42762
nodejs
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-debuginfo
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-debugsource
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-devel
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-docs
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-full-i18n
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-nodemon
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_eus:8.2::appstream
From an advisory covering 11 CVEs
 before 1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b
1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b
nodejs
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-debuginfo
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-debugsource
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-devel
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-docs
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-full-i18n
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-nodemon
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_eus:8.1::appstream
From an advisory covering 11 CVEs
 before 1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec
1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec
nodejs
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:12.22.3-2.module+el8.4.0+638+5344c6f7
1:12.22.3-2.module+el8.4.0+638+5344c6f7
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.0.3-1.module+el8.6.0+982+9fdca2d4
0:2.0.3-1.module+el8.6.0+982+9fdca2d4
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.0.3-1.module+el8.3.0+100+234774f7
0:2.0.3-1.module+el8.3.0+100+234774f7
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2.0.3-1.module+el8.4.0+638+5344c6f7
0:2.0.3-1.module+el8.4.0+638+5344c6f7
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
nodejs
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:14.17.3-2.module+el8.4.0+639+18660d0d
1:14.17.3-2.module+el8.4.0+639+18660d0d
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:23-3.module+el8.7.0+1071+4bdda2a8
0:23-3.module+el8.7.0+1071+4bdda2a8
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:23-3.module+el8.3.0+100+234774f7
0:23-3.module+el8.3.0+100+234774f7
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:23-3.module+el8.5.0+733+de4fee6c
0:23-3.module+el8.5.0+733+de4fee6c
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 4 CVEs
 before 14.17.2-6.12.1
14.17.2-6.12.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 6 CVEs
 before 10.24.1-1.39.1
10.24.1-1.39.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 6 CVEs
 before 12.22.2-1.32.1
12.22.2-1.32.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 6 CVEs
 before 12.22.2-4.16.1
12.22.2-4.16.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 6 CVEs
 before 12.22.2-4.16.1
12.22.2-4.16.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Manager Proxy 4.0
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Manager Retail Branch Server 4.0
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Manager Server 4.0
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Enterprise Storage 6
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 4 CVEs
 before 14.17.2-5.12.1
14.17.2-5.12.1
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 4 CVEs
 before 14.17.2-5.12.1
14.17.2-5.12.1
nodejs8
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 3 CVEs
 before 8.17.0-10.12.2
8.17.0-10.12.2
nodejs-common
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs-common
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
nodejs-common
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
nodejs-common
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
nodejs-common
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
nodejs-common
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
nodejs-common
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
nodejs-common
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
nodejs-common
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
nodejs-common
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
nodejs-common
SUSE:Manager Proxy 4.0
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Manager Proxy 4.0
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
nodejs-common
SUSE:Manager Retail Branch Server 4.0
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Manager Retail Branch Server 4.0
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
nodejs-common
SUSE:Manager Server 4.0
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Manager Server 4.0
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
nodejs-common
SUSE:Enterprise Storage 6
From an advisory covering 4 CVEs
 before 2.0-3.2.1
2.0-3.2.1
nodejs8
SUSE:Enterprise Storage 6
From an advisory covering 4 CVEs
 before 8.17.0-3.47.2
8.17.0-3.47.2
node-hosted-git-info
Ubuntu:Pro:18.04:LTS
 before 2.5.0-1ubuntu0.1~esm1, plus listed versions
2.1.5-12.5.0-1
2.5.0-1ubuntu0.1~esm1
node-hosted-git-info
Ubuntu:Pro:20.04:LTS
 before 2.8.5-1ubuntu0.1~esm1, plus listed versions
2.7.1-12.8.5-1
2.8.5-1ubuntu0.1~esm1
nodejs12
openSUSE:Leap 15.2
From an advisory covering 6 CVEs
 before 12.22.2-lp152.3.15.1
12.22.2-lp152.3.15.1
nodejs14
openSUSE:Leap 15.2
From an advisory covering 4 CVEs
 before 14.17.2-lp152.11.1
14.17.2-lp152.11.1
nodejs10
openSUSE:Leap 15.2
From an advisory covering 6 CVEs
 before 10.24.1-lp152.2.15.1
10.24.1-lp152.2.15.1
nodejs8
openSUSE:Leap 15.2
From an advisory covering 3 CVEs
 before 8.17.0-lp152.3.14.1
8.17.0-lp152.3.14.1
nodejs12
openSUSE:Leap 15.3
From an advisory covering 6 CVEs
 before 12.22.2-4.16.1
12.22.2-4.16.1
nodejs10
openSUSE:Leap 15.3
From an advisory covering 6 CVEs
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs14
openSUSE:Leap 15.3
From an advisory covering 4 CVEs
 before 14.17.2-5.12.1
14.17.2-5.12.1
nodejs8
openSUSE:Leap 15.3
From an advisory covering 3 CVEs
 before 8.17.0-10.12.2
8.17.0-10.12.2

History

History
RecordedChangedSources
affected
factsOSV
affected
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-23362 is a medium vulnerability (CVSS 5.3) in Npmjs Hosted-git-info, published March 23, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.61%, the 89th percentile. Fixed in hosted-git-info 3.0.8.

References

Show 127 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open