{"id":"CVE-2019-16776","aliases":["ALEA-2020:0330","ALSA-2020:0579","DEBIAN-CVE-2019-16776","EUVD-2019-0805","GHSA-x8qc-rrcw-4r46","MGASA-2020-0372","RHEA-2020:0330","RHSA-2020:0573","RHSA-2020:0579","RHSA-2020:0597","RHSA-2020:0602","RHSA-2020:2625","RLSA-2020:0579","SUSE-SU-2020:0043-1","SUSE-SU-2020:0063-1","SUSE-SU-2020:0104-1","SUSE-SU-2020:0247-1","SUSE-SU-2020:0429-1","UBUNTU-CVE-2019-16776","openSUSE-SU-2020:0059-1"],"status":"published","title":"Unauthorized File Access in npm CLI before before version 6.13.3","description":"Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03412,"percentile":0.88971,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2019-12-13T00:55:16Z","modified":"2026-10-29T11:12:10Z","fixes":[{"ecosystem":"npm","package":"npm","fixed_in":["6.13.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"npm","fixed_in":["6.13.4+ds-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"npm","fixed_in":["6.13.4+ds-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"npm","fixed_in":["6.13.4+ds-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.4+ds-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.4+ds-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.4+ds-2"}]}]},{"source":"osv","ecosystem":"npm","package":"npm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.13.3"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2-1.mga7"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:7","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-9.mga7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.14.1-1.module+el8.1.0+5466+30f75629"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.14.1-1.module+el8.1.0+5466+30f75629"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.14.1-1.module+el8.1.0+5466+30f75629"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.14.1-1.module+el8.1.0+5466+30f75629"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.14.1-1.module+el8.1.0+5466+30f75629"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.13.4-1.12.14.1.1.module+el8.1.0+5466+30f75629"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.19.0-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.19.0-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.19.0-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.19.0-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.13.4-10.19.0.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.16.1-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.16.1-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.16.1-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.16.1-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.13.4-12.16.1.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.17.0-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.17.0-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.17.0-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.17.0-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.13.4-8.17.0.2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.18.0-1.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.18.0-1.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.18.0-1.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-11.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-11.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-11.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-11.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-1.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.18~dfsg-3","1.3.10~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.21+ds-2","3.5.2-0ubuntu4","3.5.2-0ubuntu4.1.16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.2-0ubuntu4","3.5.2-0ubuntu4.1.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0+ds6-4","6.14.4+ds-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.5.2+ds-2","7.24.2+ds-1","7.24.2+ds-2","8.3.0~ds-1","8.3.0~ds-2","8.3.2~ds-1","8.5.0~ds-1","8.5.1~ds-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.0~ds1-1","9.2.0~ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.0~ds1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.0~ds3-1","11.16.0+ds2-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.0~ds1-3","9.2.0~ds2-2","9.2.0~ds3-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-lp151.2.9.1"}]}],"bundled":3}],"products":[{"vendor":"cli","product":"cli"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"npm","product":"cli"},{"vendor":"npmjs","product":"npm"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"graalvm"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"}],"references":[{"url":"https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHEA-2020:0330","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0573","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0579","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0597","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0602","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16776","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x8qc-rrcw-4r46","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/1436","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/"},{"url":"https://errata.almalinux.org/8/ALEA-2020-0330.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-16775","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-16776","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-16777","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-0579.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-15604","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-15605","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-15606","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-16776","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2020-0372.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25314","tags":["report"]},{"url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/","tags":["web","article"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/","tags":["web"]},{"url":"https://github.com/nodejs/node/blob/v10.x/doc/changelogs/CHANGELOG_V10.md","tags":["web"]},{"url":"https://github.com/nghttp2/nghttp2/releases/","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1791067","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhea-2020_0330.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16775","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788310","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16776","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788301","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16777","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1800364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1800366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1800367","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0573.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15604","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15604","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15604","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15605","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15605","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15605","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15606","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15606","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15606","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0579.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0597.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0602.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2625","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1567228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1611613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1829414","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2625.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18077","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18077","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18077","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18869","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3737","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3737","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3737","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3750","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3750","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3750","tags":["advisory"]},{"url":"https://hackerone.com/reports/311333","tags":["article"]},{"url":"https://nodesecurity.io/advisories/612","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2020:0579","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200043-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149792","tags":["report"]},{"url":"https://bugzilla.suse.com/1159352","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16777","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200063-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159812","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200104-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200247-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200429-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1163102","tags":["report"]},{"url":"https://bugzilla.suse.com/1163103","tags":["report"]},{"url":"https://bugzilla.suse.com/1163104","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15606","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-16776","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZTYFGA4QM5SQ3SGXQOYK3EH3UJ2NB6H7/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-16776","title":"Unauthorized File Access in npm CLI before before version 6.13.3","description":"Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","status":"published","published":"2019-12-13T00:55:16Z","modified":"2024-08-05T01:24:48.04Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:23.485011Z"}],"euvd":[{"id":"EUVD-2019-0805","description":"Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","status":"published","published":"2019-12-13T00:55:16Z","modified":"2024-08-05T01:24:48Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T02:40:31.903592Z"}],"ghsa":[{"id":"GHSA-x8qc-rrcw-4r46","title":"npm symlink reference outside of node_modules","description":"Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules. It is possible for packages to create symlinks to files outside of the`node_modules` folder through the `bin` field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the `npm install` are affected.  \n\nThis behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.\n\n\n## Recommendation\n\nUpgrade to version 6.13.3 or later.","status":"published","published":"2019-12-13T15:39:26Z","modified":"2023-01-29T05:02:54Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:25.064927Z"}],"nvd":[{"id":"CVE-2019-16776","description":"Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","status":"published","published":"2019-12-13T01:15:10.913Z","modified":"2026-06-17T02:22:46.737Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:40.258829Z"}],"osv":[{"id":"CVE-2019-16776","description":"Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","status":"published","published":"2019-12-13T01:15:10.913Z","modified":"2026-10-29T11:12:10.366338893Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-16776","description":"Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","status":"published","published":"2019-12-13T01:15:10.913Z","modified":"2026-09-21T07:01:15.173378808Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"GHSA-x8qc-rrcw-4r46","title":"npm symlink reference outside of node_modules","description":"Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules. It is possible for packages to create symlinks to files outside of the`node_modules` folder through the `bin` field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the `npm install` are affected.  \n\nThis behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.\n\n\n## Recommendation\n\nUpgrade to version 6.13.3 or later.","status":"published","published":"2019-12-13T15:39:26Z","modified":"2026-09-10T03:49:24.820425242Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"RHEA-2020:0330","title":"Red Hat Enhancement Advisory: nodejs:12 enhancement update","status":"published","published":"2024-09-13T16:10:40Z","modified":"2026-06-29T10:28:18Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2020:0573","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T16:15:55Z","modified":"2026-06-29T10:28:51Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0579","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T16:16:24Z","modified":"2026-06-29T10:28:52Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0597","title":"Red Hat Security Advisory: rh-nodejs10-nodejs security update","status":"published","published":"2024-09-13T16:16:13Z","modified":"2026-06-29T10:28:54Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0602","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T16:15:44Z","modified":"2026-06-29T10:28:56Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:2625","title":"Red Hat Security Advisory: rh-nodejs8-nodejs security update","status":"published","published":"2024-09-13T16:20:13Z","modified":"2026-06-28T10:37:33Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RLSA-2020:0579","title":"Important: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nThe following packages have been upgraded to a later upstream version: nodejs (10.19.0).\n\nSecurity Fix(es):\n\n* nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)\n\n* nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)\n\n* nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)\n\n* npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)\n\n* npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)\n\n* npm: Global node_modules Binary Overwrite (CVE-2019-16777)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-02-25T07:57:02Z","modified":"2026-02-05T01:15:07.968339Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-16776","description":"Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","status":"published","published":"2019-12-13T01:15:00Z","modified":"2026-10-17T12:55:42.648188157Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"ALEA-2020:0330","title":"nodejs:12 enhancement update","description":"The following packages have been upgraded to a later upstream version: nodejs (12.14.1). (BZ#1791067)","status":"published","published":"2020-02-04T08:35:22Z","modified":"2026-10-29T11:00:23.254578641Z","updated_at":"2026-11-02T15:27:45.973197Z"},{"id":"ALSA-2020:0579","title":"Important: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nThe following packages have been upgraded to a later upstream version: nodejs (10.19.0).\n\nSecurity Fix(es):\n\n* nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)\n\n* nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)\n\n* nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)\n\n* npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)\n\n* npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)\n\n* npm: Global node_modules Binary Overwrite (CVE-2019-16777)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-02-25T07:57:02Z","modified":"2026-10-29T11:00:05.743563773Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"MGASA-2020-0372","title":"Updated nodejs packages fix security vulnerabilities","description":"The nodejs package has been updated to the latest version in the 10.x branch,\nwhich is 10.22.1 at this time.  It fixes several security issues and other\nbugs.  See the upstream changelog and advisories for details.\n","status":"published","published":"2020-09-27T20:06:37Z","modified":"2026-04-16T04:43:16.918624291Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:0059-1","title":"Security update for nodejs8","description":"This update for nodejs8 to version 8.17.0 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing\n    an arbitrary path overwrite and access via 'bin' field (bsc#1159352).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-01-14T23:14:09Z","modified":"2026-02-04T03:56:41.627685Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2020:0043-1","title":"Security update for nodejs8","description":"This update for nodejs8 to version 8.17.0 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing\n    an arbitrary path overwrite and access via 'bin' field (bsc#1159352).\n","status":"published","published":"2020-01-08T13:55:19Z","modified":"2026-02-04T03:47:24.585459Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0063-1","title":"Security update for nodejs10","description":"This update for nodejs10 to version 10.18.0 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing\n    an arbitrary path overwrite and access via 'bin' field (bsc#1159352).\n- Added support for chacha20-poly1305 for Authenticated encryption (AEAD).\n\nNon-security issues fixed:\n\n- Fix wrong path in gypi files (bsc#1159812)\n","status":"published","published":"2020-01-10T10:01:40Z","modified":"2026-02-04T02:18:05.836292Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0104-1","title":"Security update for nodejs10","description":"This update for nodejs10 to version 10.18.0 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing\n    an arbitrary path overwrite and access via 'bin' field (bsc#1159352).\n- Added support for chacha20-poly1305 for Authenticated encryption (AEAD).\n\nNon-security issues fixed:\n\n- Fixed wrong path in gypi files (bsc#1159812).\n","status":"published","published":"2020-01-15T09:32:48Z","modified":"2026-02-04T03:57:49.496159Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0247-1","title":"Security update for nodejs6","description":"This update for nodejs6 to version 6.17.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing\n    an arbitrary path overwrite and access via 'bin' field (bsc#1159352).\n","status":"published","published":"2020-01-28T10:56:07Z","modified":"2026-02-04T03:51:41.025784Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0429-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nnodejs12 was updated to version 12.15.0.\n\nSecurity issues fixed:\n\n- CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).\n- CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).\n- CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).\n- CVE-2019-16775: Fixed an arbitrary file write vulnerability (bsc#1159352).\n- CVE-2019-16776: Fixed an arbitrary file write vulnerability (bsc#1159352).\n- CVE-2019-16777: Fixed an arbitrary file write vulnerability (bsc#1159352).\n","status":"published","published":"2020-02-20T12:28:28Z","modified":"2026-02-04T03:33:18.665432Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}