{"id":"CVE-2020-7774","aliases":["ALPINE-CVE-2020-7774","ALSA-2020:5499","ALSA-2021:0548","ALSA-2021:0551","BELL-CVE-2020-7774","CLSA-2026-1782867615","DEBIAN-CVE-2020-7774","EUVD-2021-0643","GHSA-c4w7-xm78-47vh","MGASA-2021-0372","OESA-2022-1769","RHSA-2020:5305","RHSA-2020:5499","RHSA-2021:0421","RHSA-2021:0521","RHSA-2021:0548","RHSA-2021:0551","RLSA-2020:5499","RLSA-2021:0548","RLSA-2021:0551","ROOT-APP-NPM-CVE-2020-7774","SUSE-SU-2021:2319-1","SUSE-SU-2021:2323-1","SUSE-SU-2021:2326-1","SUSE-SU-2021:2327-1","SUSE-SU-2021:2353-1","SUSE-SU-2021:2354-1","SUSE-SU-2021:2618-1","SUSE-SU-2021:2620-1","UBUNTU-CVE-2020-7774","openSUSE-SU-2021:1059-1","openSUSE-SU-2021:1060-1","openSUSE-SU-2021:1061-1","openSUSE-SU-2021:1113-1","openSUSE-SU-2021:2327-1","openSUSE-SU-2021:2353-1","openSUSE-SU-2021:2354-1","openSUSE-SU-2021:2618-1","openSUSE-SU-2024:11096-1"],"status":"published","title":"Prototype Pollution","description":"The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.69589,"percentile":0.99371,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-20","CWE-915"],"published":"2020-11-17T12:30:20Z","modified":"2026-11-04T10:45:07Z","fixes":[{"ecosystem":"npm","package":"y18n","fixed_in":["3.2.2","4.0.1","5.0.5"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.10","package":"nodejs","fixed_in":["10.24.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"nodejs","fixed_in":["12.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs","fixed_in":["12.22.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs","fixed_in":["14.16.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs","fixed_in":["14.16.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["14.16.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["14.16.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["14.16.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["14.16.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["14.16.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["14.16.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["14.16.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["14.16.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["14.16.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["14.16.1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"y18n","fixed_in":["4.0.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-y18n","fixed_in":["4.0.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-y18n","fixed_in":["4.0.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-y18n","fixed_in":["4.0.0-3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"y18n","fixed_in":["3.2.1-aikido.1","4.0.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/y18n","fixed_in":["3.2.1-root.io.1","4.0.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"ghsa","ecosystem":"npm","package":"y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.16.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.16.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.16.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.16.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.16.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.16.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.16.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.16.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.16.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.16.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.16.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.16.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.5.0+254+b4526b16"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-tuxcare.0"},{"fixed":"4.0.0-tuxcare.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"Debian:12","package":"node-y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-3"}]}]},{"source":"osv","ecosystem":"npm","package":"y18n","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"y18n","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.1"}]}],"versions":["4.0.0"]},{"source":"osv","ecosystem":"npm","package":"y18n","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.5"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.3-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.11-1.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.11-1.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.19.1-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.19.1-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.19.1-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.19.1-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.8-12.19.1.2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.19.1-1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.19.1-1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.19.1-1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.19.1-1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.19.1-1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.19.1-1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.8-1.12.19.1.1.module+el8.3.0+8851+b7b41ca0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-14.15.4.2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-10.23.1.2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+6519+9f98ed83"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.14.15.4.2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":7},{"source":"osv","ecosystem":"Root:npm","package":"y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-aikido.1"},{"fixed":"4.0.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-root.io.1"},{"fixed":"4.0.0-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.2-6.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.39.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.2-1.32.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.2-4.16.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.2-4.16.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.2-5.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.2-5.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.12.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-y18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.0-4","5.0.8-2","5.0.8+~5.0.0-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.2-lp152.3.15.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.2-lp152.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-lp152.2.15.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-lp152.3.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.2-4.16.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.2-5.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.12.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-1.2"}]}],"bundled":19}],"products":[{"vendor":"oracle","product":"graalvm"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"},{"vendor":"y18n_project","product":"y18n"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-Y18N-1021887","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web","article","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/yargs/y18n/pull/108","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/yargs/y18n/issues/96","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7774","tags":["advisory"]},{"url":"https://github.com/yargs/y18n/commit/a9ac604abf756dec9687be3843e2c93bfe581f25","tags":["web"]},{"url":"https://github.com/yargs/y18n/commit/90401eea9062ad498f4f792e3fff8008c4c193a3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c4w7-xm78-47vh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-7774","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-5499.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-15366","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7608","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7774","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8277","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-0548.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-15095","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7754","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7788","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8116","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8252","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8265","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8287","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-0551.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-7774","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-7774","tags":["advisory"]},{"url":"https://github.com/yargs/y18n","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0372.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29028","tags":["report"]},{"url":"https://nodejs.org/en/blog/release/v14.17.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v14.17.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v14.17.2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v14.17.3/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v14.16.1/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TE6GHYMCD4SLCPTFPANLIYWCPHXC4G5T/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1769","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15095","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3918","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5305","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898680","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5305.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7608","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1840004","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7608","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7774","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7774","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8277","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8277","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15366","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-AJV-584908","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5499","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5499.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0421","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912863","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0421.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7754","tags":["advisory"]},{"url":"https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8265","tags":["advisory"]},{"url":"https://hackerone.com/reports/988103","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8287","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8287","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0521","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879315","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0521.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8116","tags":["advisory"]},{"url":"https://hackerone.com/reports/719856","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8252","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15095","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0548","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0548.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0551","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0551.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:5499","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0548","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0551","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212319-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184450","tags":["report"]},{"url":"https://bugzilla.suse.com/1187973","tags":["report"]},{"url":"https://bugzilla.suse.com/1187976","tags":["report"]},{"url":"https://bugzilla.suse.com/1187977","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27290","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212323-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183155","tags":["report"]},{"url":"https://bugzilla.suse.com/1183851","tags":["report"]},{"url":"https://bugzilla.suse.com/1183852","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3450","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212326-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212327-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212353-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212354-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212618-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212620-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182620","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22884","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-7774","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4ZO2DR7PIGZWRPXIGYAZCAL4X64BSDZJ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OF3JILGLPQ2UFZS55L7Z33X7S4K562O7/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SR22RRAXGLDTLSDJRAQ4O3Q67G2PNEGJ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QQFKBXOTTNWYS2GOQXWGPFT7H3TPVQVC/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OFQOZ4RLN343RY5DDFVA2KWFMZHZD2KS/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SVLFLECFVPSHO4SQBVWDO2CBAU5LB7IS/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DYHLAI3M6J7NTEFF5DUEXHFHPTDMGRCD/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KZHYVND24KFSRRA7YPSSI2T72HICGJ3Z/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3672","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-7774","title":"Prototype Pollution","description":"The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.","status":"published","published":"2020-11-17T12:30:20.482Z","modified":"2024-09-16T20:13:29.664Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:58.331892Z"}],"euvd":[{"id":"EUVD-2021-0643","description":"The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.","status":"published","published":"2020-11-17T12:30:20Z","modified":"2024-09-16T20:13:29Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P","level":"high"}],"updated_at":"2026-11-03T00:55:15.889317Z"}],"ghsa":[{"id":"GHSA-c4w7-xm78-47vh","title":"Prototype Pollution in y18n","description":"### Overview\n\nThe npm package `y18n` before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution. \n\n### POC\n\n```js\nconst y18n = require('y18n')();\n\ny18n.setLocale('__proto__');\ny18n.updateLocale({polluted: true});\n\nconsole.log(polluted); // true\n```\n\n### Recommendation\n\nUpgrade to version 3.2.2, 4.0.1, 5.0.5 or later.","status":"published","published":"2021-03-29T16:05:12Z","modified":"2023-11-29T22:45:30Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-20","CWE-915","CWE-1321"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2020-7774","description":"The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.","status":"published","published":"2020-11-17T13:15:12.633Z","modified":"2026-06-17T03:25:25.397Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:06:25.394006Z"}],"osv":[{"id":"ALPINE-CVE-2020-7774","description":"The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.","status":"published","published":"2020-11-17T13:15:12.633Z","modified":"2026-10-26T11:17:55.181131113Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-7774","title":"CVE-2020-7774 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:04.243927Z","modified":"2026-02-18T07:38:23.868815Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-7774","description":"The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.","status":"published","published":"2020-11-17T13:15:12.633Z","modified":"2026-11-09T10:45:21.519473446Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"DEBIAN-CVE-2020-7774","description":"The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.","status":"published","published":"2020-11-17T13:15:12.633Z","modified":"2026-10-26T12:02:45.261971666Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-c4w7-xm78-47vh","title":"Prototype Pollution in y18n","description":"### Overview\n\nThe npm package `y18n` before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution. \n\n### POC\n\n```js\nconst y18n = require('y18n')();\n\ny18n.setLocale('__proto__');\ny18n.updateLocale({polluted: true});\n\nconsole.log(polluted); // true\n```\n\n### Recommendation\n\nUpgrade to version 3.2.2, 4.0.1, 5.0.5 or later.","status":"published","published":"2021-03-29T16:05:12Z","modified":"2024-12-05T15:28:53.812442Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-1321","CWE-20","CWE-915"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"OESA-2022-1769","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\r\n\r\nVersions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \u0026quot;\u0026lt;protocol\u0026gt;://[\u0026lt;user\u0026gt;[:\u0026lt;password\u0026gt;]@]\u0026lt;hostname\u0026gt;[:\u0026lt;port\u0026gt;][:][/]\u0026lt;path\u0026gt;\u0026quot;. The password value is not redacted and is printed to stdout and also to any generated log files.(CVE-2020-15095)\n\nThis affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require( y18n )(); y18n.setLocale( proto ); y18n.updateLocale({polluted: true}); console.log(polluted); // true(CVE-2020-7774)\n\nThis affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.(CVE-2020-7754)\n\nThis affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.(CVE-2020-7788)\n\njson-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ( Prototype Pollution )(CVE-2021-3918)","status":"published","published":"2022-07-22T11:05:02Z","modified":"2026-08-18T01:16:49.916974922Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2020:5305","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T22:43:51Z","modified":"2026-10-13T10:01:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5499","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-09-13T22:43:02Z","modified":"2026-10-13T10:01:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2021:0421","title":"Red Hat Security Advisory: rh-nodejs14-nodejs security update","status":"published","published":"2024-09-13T22:43:44Z","modified":"2026-10-13T10:02:07Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0521","title":"Red Hat Security Advisory: rh-nodejs10-nodejs security update","status":"published","published":"2024-09-13T22:43:33Z","modified":"2026-10-14T10:01:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0548","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T22:43:41Z","modified":"2026-10-14T10:01:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0551","title":"Red Hat Security Advisory: nodejs:14 security and bug fix update","status":"published","published":"2024-09-13T22:43:56Z","modified":"2026-10-13T10:02:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2020:5499","title":"Moderate: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)","status":"published","published":"2020-12-15T16:03:21Z","modified":"2026-02-04T14:45:04.239839Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:0548","title":"Moderate: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:15Z","modified":"2026-02-04T20:15:14.123658Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:0551","title":"Moderate: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.15.4).\n\nSecurity Fix(es):\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)","status":"published","published":"2021-02-16T07:34:42Z","modified":"2026-02-04T22:30:04.79773Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-7774","description":"The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.","status":"published","published":"2020-11-17T13:15:00Z","modified":"2025-10-24T04:48:19Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"ALSA-2020:5499","title":"Moderate: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:12 on aarch64 (BZ#1901045)","status":"published","published":"2020-12-15T16:03:21Z","modified":"2026-10-29T11:12:09.500731587Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:0548","title":"Moderate: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:15Z","modified":"2026-10-29T11:00:27.308699758Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:0551","title":"Moderate: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.15.4).\n\nSecurity Fix(es):\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)","status":"published","published":"2021-02-16T07:34:42Z","modified":"2026-10-29T11:00:40.22016781Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1782867615","title":"TuxCare security update for y18n (1 CVE)","description":"TuxCare rebuilt y18n to address 1 CVE. Fixed in 4.0.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:40Z","modified":"2026-10-15T09:47:51.65145972Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"MGASA-2021-0372","title":"Updated nodejs packages fix security vulnerabilities","description":"This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix:\nconst y18n = require('y18n')();\ny18n.setLocale('__proto__'); y18n.updateLocale({polluted: true});\nconsole.log(polluted); // true (CVE-2020-7774).\n\nThe package hosted-git-info before 3.0.8 are vulnerable to Regular Expression\nDenial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl\nfunction in index.js. The affected regular expression exhibits polynomial\nworst-case time complexity (CVE-2021-23362).\n\nssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression\nwhich is vulnerable to a denial of service. Malicious SRIs could take an\nextremely long time to process, leading to denial of service. This issue only\naffects consumers using the strict option (CVE-2021-27290).\n\nTheses issues are fixed by upgrading nodejs packages to latest available\nLTS 14.17.3 version. See upstream releases notes for other included bugfixes.\n","status":"published","published":"2021-07-25T14:45:06Z","modified":"2026-04-16T04:43:46.666010956Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:1059-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- update to 12.22.2:\n- CVE-2021-22918: Out of bounds read (bsc#1187973)\n- CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)\n- CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-07-19T21:03:47Z","modified":"2026-02-04T03:36:33.643807Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1060-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\nUpdate nodejs14 to 14.17.2.\n\nIncluding fixes for:\n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-07-19T21:03:51Z","modified":"2026-02-04T03:13:28.709768Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1061-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\nUpdate nodejs10 to 10.24.1.\n\nIncluding fixes for \n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- reduce memory footprint of test-worker-stdio (bsc#1183155)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-07-19T21:03:56Z","modified":"2026-02-04T03:25:11.06458Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1113-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- update to npm 6.14.13\n- CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)\n- CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977)\n- CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-08-09T22:41:17Z","modified":"2026-02-04T04:07:33.250989Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:2327-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- update to 12.22.2:\n- CVE-2021-22918: Out of bounds read (bsc#1187973)\n- CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)\n- CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)\n","status":"published","published":"2021-07-14T15:08:18Z","modified":"2026-02-04T03:39:08.248368Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2353-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\nUpdate nodejs10 to 10.24.1.\n\nIncluding fixes for \n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- reduce memory footprint of test-worker-stdio (bsc#1183155)\n","status":"published","published":"2021-07-15T13:18:04Z","modified":"2026-02-04T04:29:59.542005Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2354-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\nUpdate nodejs14 to 14.17.2.\n\nIncluding fixes for:\n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n","status":"published","published":"2021-07-15T13:19:02Z","modified":"2026-02-04T04:00:00.176756Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2618-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- update to npm 6.14.13\n- CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)\n- CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977)\n- CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450)\n","status":"published","published":"2021-08-05T08:28:09Z","modified":"2026-02-04T03:36:36.287805Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11096-1","title":"nodejs14-14.17.5-1.2 on GA media","description":"These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:39:56.833198Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"ROOT-APP-NPM-CVE-2020-7774","title":"CVE-2020-7774 in y18n - Patched by Root","description":"Root has patched CVE-2020-7774 in the y18n package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-10T05:49:29Z","modified":"2026-09-10T06:15:05.280101193Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"SUSE-SU-2021:2319-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\nUpdate nodejs14 to 14.17.2.\n\nIncluding fixes for:\n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n","status":"published","published":"2021-07-14T14:51:28Z","modified":"2026-02-04T02:38:30.088337Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2323-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\nUpdate nodejs10 to 10.24.1.\n\nIncluding fixes for \n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n","status":"published","published":"2021-07-14T15:04:31Z","modified":"2026-02-04T04:29:24.406914Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2326-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- update to 12.22.2:\n- CVE-2021-22918: Out of bounds read (bsc#1187973)\n- CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)\n- CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)\n","status":"published","published":"2021-07-14T15:07:58Z","modified":"2026-02-04T02:45:57.457347Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2327-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- update to 12.22.2:\n- CVE-2021-22918: Out of bounds read (bsc#1187973)\n- CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)\n- CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)\n","status":"published","published":"2021-07-14T15:08:17Z","modified":"2026-02-04T04:38:49.641996Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2353-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\nUpdate nodejs10 to 10.24.1.\n\nIncluding fixes for \n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- reduce memory footprint of test-worker-stdio (bsc#1183155)\n","status":"published","published":"2021-07-15T13:18:32Z","modified":"2026-02-04T04:22:58.524075Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2354-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\nUpdate nodejs14 to 14.17.2.\n\nIncluding fixes for:\n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n","status":"published","published":"2021-07-15T13:19:01Z","modified":"2026-02-04T03:43:46.364934Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2618-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- update to npm 6.14.13\n- CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)\n- CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977)\n- CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450)\n","status":"published","published":"2021-08-05T08:28:03Z","modified":"2026-02-04T02:44:19.56497Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2620-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- update to npm 6.14.13\n- CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)\n- CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)\n","status":"published","published":"2021-08-05T08:36:27Z","modified":"2026-02-04T03:00:31.807562Z","updated_at":"2026-11-02T15:53:49.605187Z"}]}}