GHSA-57cf-349j-352g
Out-of-bounds Read in npmconf
Versions of npmconf before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x.
Recommendation
Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used.
What each source reports
GitHub AdvisoriesNo score
Out-of-bounds Read in npmconf
Versions of npmconf before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x.
Recommendation
Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used.
- Record
GHSA-57cf-349j-352g- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVNo score
Out-of-bounds Read in npmconf
Versions of npmconf before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x.
Recommendation
Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used.
- Record
GHSA-57cf-349j-352g- Weakness
- CWE-125
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
npmconfnpm | before 2.1.3 | 2.1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-57cf-349j-352g is a vulnerability with no CVSS score yet in npmconf, published June 12, 2019. No source lists public exploit code. Fixed in npmconf 2.1.3.