GHSA-v45m-2wcp-gg98
Global node_modules Binary Overwrite in bin-links
Versions of bin-links prior to 1.1.6 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the first binary. This behavior is still allowed in local installations.
Recommendation
Upgrade to version 1.1.6 or later.
What each source reports
GitHub AdvisoriesNo score
Global node_modules Binary Overwrite in bin-links
Versions of bin-links prior to 1.1.6 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the first binary. This behavior is still allowed in local installations.
Recommendation
Upgrade to version 1.1.6 or later.
- Record
GHSA-v45m-2wcp-gg98- Updated
- 2026-11-02
OSVNo score
Global node_modules Binary Overwrite in bin-links
Versions of bin-links prior to 1.1.6 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the first binary. This behavior is still allowed in local installations.
Recommendation
Upgrade to version 1.1.6 or later.
- Record
GHSA-v45m-2wcp-gg98- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bin-linksnpm | before 1.1.6 | 1.1.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-v45m-2wcp-gg98 is a vulnerability with no CVSS score yet in bin-links, published September 4, 2020. No source lists public exploit code. Fixed in bin-links 1.1.6.