Every CVE Search/ Get API key

CVE-2022-29244

npm packing does not respect root-level ignore files in workspaces

7.5 HighFix available

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

4.00%Up 2.7 points since Jun 14, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Record
CVE-2022-29244
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List 7.5

npm packing does not respect root-level ignore files in workspaces

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Record
CVE-2022-29244
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2022-6068 7.5

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Record
EUVD-2022-6068
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hj9c-8jmm-8c52 7.5

Packing does not respect root-level ignore files in workspaces

Impact

npm pack ignores root-level .gitignore & .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish with workspaces, as of v7.9.0 & v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include.

Patch

  • Upgrade to the latest, patched version of npm (v8.11.0 or greater), run: npm i -g npm@latest
  • Node.js versions v16.15.1, v17.19.1 & v18.3.0 include the patched v8.11.0 version of npm

Steps to take to see if you're impacted

  1. Run npm publish --dry-run or npm pack with an npm version >=7.9.0 & <8.11.0 inside the project's root directory using a workspace flag like: --workspaces or --workspace=<name> (ex. npm pack --workspace=foo)
  2. Check the output in your terminal which will list the package contents (note: tar -tvf <package-on-disk> also works)
  3. If you find that there are files included you did not expect, you should: 3.1. Create & publish a new release excluding those files (ref. "Keeping files out of your Package") 3.2. Deprecate the old package (ex. npm deprecate <pkg>[@<version>] <message>) 3.3. Revoke or rotate any sensitive information (ex. passwords, tokens, secrets etc.) which might have been exposed

References

Record
GHSA-hj9c-8jmm-8c52
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 7.5

npm packing does not respect root-level ignore files in workspaces

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Record
CVE-2022-29244
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVGHSA-hj9c-8jmm-8c52 7.5

Packing does not respect root-level ignore files in workspaces

Impact

npm pack ignores root-level .gitignore & .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish with workspaces, as of v7.9.0 & v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include.

Patch

  • Upgrade to the latest, patched version of npm (v8.11.0 or greater), run: npm i -g npm@latest
  • Node.js versions v16.15.1, v17.19.1 & v18.3.0 include the patched v8.11.0 version of npm

Steps to take to see if you're impacted

  1. Run npm publish --dry-run or npm pack with an npm version >=7.9.0 & <8.11.0 inside the project's root directory using a workspace flag like: --workspaces or --workspace=<name> (ex. npm pack --workspace=foo)
  2. Check the output in your terminal which will list the package contents (note: tar -tvf <package-on-disk> also works)
  3. If you find that there are files included you did not expect, you should: 3.1. Create & publish a new release excluding those files (ref. "Keeping files out of your Package") 3.2. Deprecate the old package (ex. npm deprecate <pkg>[@<version>] <message>) 3.3. Revoke or rotate any sensitive information (ex. passwords, tokens, secrets etc.) which might have been exposed

References

Record
GHSA-hj9c-8jmm-8c52
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
Show 8 moreShow less
OSVRHSA-2022:6595 7.5

Red Hat Security Advisory: nodejs and nodejs-nodemon security and bug fix update

Record
RHSA-2022:6595
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:6595 7.5

Moderate: nodejs and nodejs-nodemon security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)

Security Fix(es):

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)

  • nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

  • nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

  • nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

  • nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

  • got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [Rocky Linux-9] (BZ#2121019)

  • nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)

Record
RLSA-2022:6595
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-29244 7.5

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Record
UBUNTU-CVE-2022-29244
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2022:6595 No score

Moderate: nodejs and nodejs-nodemon security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)

Security Fix(es):

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)
  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)
  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
  • normalize-url: ReDoS for data URLs (CVE-2021-33502)
  • nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)
  • nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)
  • nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)
  • nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)
  • nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)
  • got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [almalinux-9] (BZ#2121019)
  • nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)
Record
ALSA-2022:6595
Updated
2026-11-02
OSVopenSUSE-SU-2024:12280-1 No score

corepack16-16.17.0-1.1 on GA media

These are all security issues fixed in the corepack16-16.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12280-1
Updated
2026-11-02
OSVSUSE-SU-2022:3196-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).
  • CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
  • CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).
  • CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

Bugfixes:

  • Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)
Record
SUSE-SU-2022:3196-1
Updated
2026-11-02
OSVSUSE-SU-2022:3250-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).
  • CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
  • CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).
  • CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

Bugfixes:

  • Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)
Record
SUSE-SU-2022:3250-1
Updated
2026-11-02
OSVSUSE-SU-2022:3251-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).
  • CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
  • CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).
  • CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

Bugfixes:

  • Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)
Record
SUSE-SU-2022:3251-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
npm
npm
 7.9.0 up to 8.11.0
8.11.0
nodejs
AlmaLinux:9
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-docs
AlmaLinux:9
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-full-i18n
AlmaLinux:9
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-libs
AlmaLinux:9
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-nodemon
AlmaLinux:9
 before 2.0.19-1.el9_0
2.0.19-1.el9_0
npm
AlmaLinux:9
 before 1:8.11.0-1.16.16.0.1.el9_0
1:8.11.0-1.16.16.0.1.el9_0
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
 before 0:2.0.19-1.el9_0
0:2.0.19-1.el9_0
nodejs
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
Show 22 moreShow less
Affected packages
PackageAffectedFixed
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-docs
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-libs
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
npm
Red Hat:enterprise_linux:9::appstream
 before 1:8.11.0-1.16.16.0.1.el9_0
1:8.11.0-1.16.16.0.1.el9_0
nodejs-nodemon
Rocky Linux:9
 before 0:2.0.19-1.el9_0
0:2.0.19-1.el9_0
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 16.17.0-8.9.1
16.17.0-8.9.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
 before 16.17.0-150400.3.6.1
16.17.0-150400.3.6.1
nodejs16
openSUSE:Leap 15.4
 before 16.17.0-150400.3.6.1
16.17.0-150400.3.6.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
 before 16.17.0-150300.7.9.1
16.17.0-150300.7.9.1
nodejs16
openSUSE:Leap 15.3
 before 16.17.0-150300.7.9.1
16.17.0-150300.7.9.1
npm
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.2.18~dfsg-31.3.10~dfsg-1
 None known
npm
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.4.21+ds-23.5.2-0ubuntu43.5.2-0ubuntu4.1.16.04.1~esm1
 None known
npm
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.5.2-0ubuntu43.5.2-0ubuntu4.1.18.04.1~esm1
 None known
npm
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.8.0+ds6-46.14.4+ds-1ubuntu2
 None known
npm
Ubuntu:22.04:LTS
 All versions, plus listed versions
7.5.2+ds-27.24.2+ds-17.24.2+ds-28.3.0~ds-18.3.0~ds-28.3.2~ds-18.5.0~ds-18.5.1~ds-1
 None known
npm
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.2.0~ds1-19.2.0~ds1-2
 None known
npm
Ubuntu:25.10
 All versions, plus listed versions
9.2.0~ds1-3
 None known
npm
Ubuntu:26.10
 All versions, plus listed versions
9.2.0~ds3-111.16.0+ds2-4
 None known
npm
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.2.0~ds1-39.2.0~ds2-29.2.0~ds3-1
 None known
nodejs16
openSUSE:Tumbleweed
 before 16.17.0-1.1
16.17.0-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-29244 is a high vulnerability (CVSS 7.5) in Npm, published June 2, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.00%, the 90th percentile. Fixed in npm 8.11.0.

References

Show 83 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open