{"id":"CVE-2019-16777","aliases":["ALEA-2020:0330","ALSA-2020:0579","DEBIAN-CVE-2019-16777","EUVD-2019-0774","GHSA-4328-8hgf-7wjr","MGASA-2020-0372","RHEA-2020:0330","RHSA-2020:0573","RHSA-2020:0579","RHSA-2020:0597","RHSA-2020:0602","RHSA-2020:2625","RLSA-2020:0579","SUSE-SU-2020:0043-1","SUSE-SU-2020:0063-1","SUSE-SU-2020:0104-1","SUSE-SU-2020:0247-1","SUSE-SU-2020:0429-1","UBUNTU-CVE-2019-16777","openSUSE-SU-2020:0059-1"],"status":"published","title":"Arbitrary File Overwrite in npm CLI","description":"Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02043,"percentile":0.8142,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-269"],"published":"2019-12-13T01:00:21Z","modified":"2026-10-29T11:12:11Z","fixes":[{"ecosystem":"npm","package":"npm","fixed_in":["6.13.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"npm","fixed_in":["6.13.4+ds-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"npm","fixed_in":["6.13.4+ds-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"npm","fixed_in":["6.13.4+ds-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.4+ds-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.4+ds-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13.4+ds-2"}]}]},{"source":"osv","ecosystem":"npm","package":"npm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.13.4"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2-1.mga7"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:7","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-9.mga7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.14.1-1.module+el8.1.0+5466+30f75629"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.14.1-1.module+el8.1.0+5466+30f75629"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.14.1-1.module+el8.1.0+5466+30f75629"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.14.1-1.module+el8.1.0+5466+30f75629"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.14.1-1.module+el8.1.0+5466+30f75629"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.13.4-1.12.14.1.1.module+el8.1.0+5466+30f75629"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.19.0-1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.19.0-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.19.0-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.19.0-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.19.0-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.13.4-10.19.0.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.16.1-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.16.1-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.16.1-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.16.1-1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.13.4-12.16.1.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.17.0-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.17.0-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.17.0-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.17.0-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.13.4-8.17.0.2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.18.0-1.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.18.0-1.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.18.0-1.15.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-11.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-11.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-11.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.1-11.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.15.0-1.6.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.18~dfsg-3","1.3.10~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.21+ds-2","3.5.2-0ubuntu4","3.5.2-0ubuntu4.1.16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.2-0ubuntu4","3.5.2-0ubuntu4.1.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0+ds6-4","6.14.4+ds-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.5.2+ds-2","7.24.2+ds-1","7.24.2+ds-2","8.3.0~ds-1","8.3.0~ds-2","8.3.2~ds-1","8.5.0~ds-1","8.5.1~ds-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.0~ds1-1","9.2.0~ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.0~ds1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.0~ds3-1","11.16.0+ds2-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.0~ds1-3","9.2.0~ds2-2","9.2.0~ds3-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-lp151.2.9.1"}]}],"bundled":3}],"products":[{"vendor":"cli","product":"cli"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"npm","product":"cli"},{"vendor":"npmjs","product":"npm"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"graalvm"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"}],"references":[{"url":"https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHEA-2020:0330","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0573","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0579","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0597","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0602","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202003-48","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16777","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4328-8hgf-7wjr","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/1437","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/"},{"url":"https://errata.almalinux.org/8/ALEA-2020-0330.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-16775","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-16776","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-16777","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-0579.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-15604","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-15605","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-15606","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-16777","tags":["advisory"]},{"url":"https://github.com/npm/cli","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2020-0372.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25314","tags":["report"]},{"url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/","tags":["web","article"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/","tags":["web"]},{"url":"https://github.com/nodejs/node/blob/v10.x/doc/changelogs/CHANGELOG_V10.md","tags":["web"]},{"url":"https://github.com/nghttp2/nghttp2/releases/","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1791067","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhea-2020_0330.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16775","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788310","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16776","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16776","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788301","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16777","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1800364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1800366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1800367","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0573.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15604","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15604","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15604","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15605","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15605","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15605","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15606","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15606","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15606","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0579.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0597.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0602.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2625","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1448380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1567228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1611613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1829414","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2625.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18077","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18077","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18077","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-18869","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-18869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18869","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3737","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3737","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3737","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3750","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3750","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3750","tags":["advisory"]},{"url":"https://hackerone.com/reports/311333","tags":["article"]},{"url":"https://nodesecurity.io/advisories/612","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2020:0579","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200043-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149792","tags":["report"]},{"url":"https://bugzilla.suse.com/1159352","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16777","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200063-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159812","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200104-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200247-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200429-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1163102","tags":["report"]},{"url":"https://bugzilla.suse.com/1163103","tags":["report"]},{"url":"https://bugzilla.suse.com/1163104","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15606","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-16777","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZTYFGA4QM5SQ3SGXQOYK3EH3UJ2NB6H7/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-16777","title":"Arbitrary File Overwrite in npm CLI","description":"Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","status":"published","published":"2019-12-13T01:00:21Z","modified":"2024-08-05T01:24:47.252Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:23.189113Z"}],"euvd":[{"id":"EUVD-2019-0774","description":"Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","status":"published","published":"2019-12-13T01:00:21Z","modified":"2024-08-05T01:24:47Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T02:40:32.32735Z"}],"ghsa":[{"id":"GHSA-4328-8hgf-7wjr","title":"npm Vulnerable to Global node_modules Binary Overwrite","description":"Versions of  the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. \n\nFor example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This will not overwrite system binaries but only binaries put into the global node_modules directory.\n\nThis behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.\n\n\n## Recommendation\n\nUpgrade to version 6.13.4 or later.","status":"published","published":"2019-12-13T15:39:32Z","modified":"2023-01-29T05:02:38Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22","CWE-269"],"updated_at":"2026-11-02T14:36:25.064927Z"}],"nvd":[{"id":"CVE-2019-16777","description":"Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","status":"published","published":"2019-12-13T01:15:11.007Z","modified":"2026-06-17T02:22:46.91Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22","CWE-269"],"updated_at":"2026-11-02T14:05:40.258829Z"}],"osv":[{"id":"CVE-2019-16777","description":"Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","status":"published","published":"2019-12-13T01:15:11.007Z","modified":"2026-10-29T11:12:11.110166005Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-16777","description":"Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","status":"published","published":"2019-12-13T01:15:11.007Z","modified":"2026-09-21T07:02:45.367026381Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"GHSA-4328-8hgf-7wjr","title":"npm Vulnerable to Global node_modules Binary Overwrite","description":"Versions of  the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. \n\nFor example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This will not overwrite system binaries but only binaries put into the global node_modules directory.\n\nThis behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.\n\n\n## Recommendation\n\nUpgrade to version 6.13.4 or later.","status":"published","published":"2019-12-13T15:39:32Z","modified":"2026-09-10T03:48:45.579434248Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22","CWE-269"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"RHEA-2020:0330","title":"Red Hat Enhancement Advisory: nodejs:12 enhancement update","status":"published","published":"2024-09-13T16:10:40Z","modified":"2026-06-29T10:28:18Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2020:0573","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T16:15:55Z","modified":"2026-06-29T10:28:51Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0579","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T16:16:24Z","modified":"2026-06-29T10:28:52Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0597","title":"Red Hat Security Advisory: rh-nodejs10-nodejs security update","status":"published","published":"2024-09-13T16:16:13Z","modified":"2026-06-29T10:28:54Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0602","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T16:15:44Z","modified":"2026-06-29T10:28:56Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:2625","title":"Red Hat Security Advisory: rh-nodejs8-nodejs security update","status":"published","published":"2024-09-13T16:20:13Z","modified":"2026-06-28T10:37:33Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RLSA-2020:0579","title":"Important: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nThe following packages have been upgraded to a later upstream version: nodejs (10.19.0).\n\nSecurity Fix(es):\n\n* nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)\n\n* nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)\n\n* nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)\n\n* npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)\n\n* npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)\n\n* npm: Global node_modules Binary Overwrite (CVE-2019-16777)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-02-25T07:57:02Z","modified":"2026-02-05T01:15:07.968339Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-16777","description":"Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.","status":"published","published":"2019-12-13T01:15:00Z","modified":"2026-10-17T12:55:41.281448312Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"ALEA-2020:0330","title":"nodejs:12 enhancement update","description":"The following packages have been upgraded to a later upstream version: nodejs (12.14.1). (BZ#1791067)","status":"published","published":"2020-02-04T08:35:22Z","modified":"2026-10-29T11:00:23.254578641Z","updated_at":"2026-11-02T15:27:45.973197Z"},{"id":"ALSA-2020:0579","title":"Important: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nThe following packages have been upgraded to a later upstream version: nodejs (10.19.0).\n\nSecurity Fix(es):\n\n* nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)\n\n* nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)\n\n* nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)\n\n* npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)\n\n* npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)\n\n* npm: Global node_modules Binary Overwrite (CVE-2019-16777)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2020-02-25T07:57:02Z","modified":"2026-10-29T11:00:05.743563773Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"MGASA-2020-0372","title":"Updated nodejs packages fix security vulnerabilities","description":"The nodejs package has been updated to the latest version in the 10.x branch,\nwhich is 10.22.1 at this time.  It fixes several security issues and other\nbugs.  See the upstream changelog and advisories for details.\n","status":"published","published":"2020-09-27T20:06:37Z","modified":"2026-04-16T04:43:16.918624291Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:0059-1","title":"Security update for nodejs8","description":"This update for nodejs8 to version 8.17.0 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing\n    an arbitrary path overwrite and access via 'bin' field (bsc#1159352).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-01-14T23:14:09Z","modified":"2026-02-04T03:56:41.627685Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2020:0043-1","title":"Security update for nodejs8","description":"This update for nodejs8 to version 8.17.0 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing\n    an arbitrary path overwrite and access via 'bin' field (bsc#1159352).\n","status":"published","published":"2020-01-08T13:55:19Z","modified":"2026-02-04T03:47:24.585459Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0063-1","title":"Security update for nodejs10","description":"This update for nodejs10 to version 10.18.0 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing\n    an arbitrary path overwrite and access via 'bin' field (bsc#1159352).\n- Added support for chacha20-poly1305 for Authenticated encryption (AEAD).\n\nNon-security issues fixed:\n\n- Fix wrong path in gypi files (bsc#1159812)\n","status":"published","published":"2020-01-10T10:01:40Z","modified":"2026-02-04T02:18:05.836292Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0104-1","title":"Security update for nodejs10","description":"This update for nodejs10 to version 10.18.0 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing\n    an arbitrary path overwrite and access via 'bin' field (bsc#1159352).\n- Added support for chacha20-poly1305 for Authenticated encryption (AEAD).\n\nNon-security issues fixed:\n\n- Fixed wrong path in gypi files (bsc#1159812).\n","status":"published","published":"2020-01-15T09:32:48Z","modified":"2026-02-04T03:57:49.496159Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0247-1","title":"Security update for nodejs6","description":"This update for nodejs6 to version 6.17.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing\n    an arbitrary path overwrite and access via 'bin' field (bsc#1159352).\n","status":"published","published":"2020-01-28T10:56:07Z","modified":"2026-02-04T03:51:41.025784Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0429-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nnodejs12 was updated to version 12.15.0.\n\nSecurity issues fixed:\n\n- CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).\n- CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).\n- CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).\n- CVE-2019-16775: Fixed an arbitrary file write vulnerability (bsc#1159352).\n- CVE-2019-16776: Fixed an arbitrary file write vulnerability (bsc#1159352).\n- CVE-2019-16777: Fixed an arbitrary file write vulnerability (bsc#1159352).\n","status":"published","published":"2020-02-20T12:28:28Z","modified":"2026-02-04T03:33:18.665432Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}