{"id":"CVE-2020-7788","aliases":["ALSA-2021:0548","ALSA-2021:0549","ALSA-2021:0551","ALSA-2021:5171","ALSA-2022:0350","ALSA-2022:6595","AZL-44679","AZL-45153","CLSA-2026-1771546204","CLSA-2026-1775608289","DEBIAN-CVE-2020-7788","DLA-2503-1","EUVD-2020-1502","GHSA-qqgx-2p2h-9c37","MGASA-2021-0068","OESA-2022-1769","RHSA-2021:0421","RHSA-2021:0485","RHSA-2021:0521","RHSA-2021:0548","RHSA-2021:0549","RHSA-2021:0551","RHSA-2021:3280","RHSA-2021:3281","RHSA-2021:5171","RHSA-2022:0246","RHSA-2022:0350","RHSA-2022:6595","RLSA-2021:0548","RLSA-2021:0549","RLSA-2021:0551","RLSA-2021:5171","RLSA-2022:0350","RLSA-2022:6595","ROOT-APP-NPM-CVE-2020-7788","SNYK-JS-INI-1048974","UBUNTU-CVE-2020-7788"],"status":"published","title":"Prototype Pollution","description":"This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03655,"percentile":0.8976,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2020-12-10T16:53:45Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"ini","fixed_in":["1.3.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"ini","fixed_in":["1.3.5-tuxcare.2","1.3.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-ini","fixed_in":["2.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-ini","fixed_in":["2.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-ini","fixed_in":["2.0.0-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"node-ini","fixed_in":["1.1.0-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"nodejs-ini","fixed_in":["1.3.8-1.mga7"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"ini","fixed_in":["1.3.5-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/ini","fixed_in":["1.3.5-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.5.0+254+b4526b16"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+246+05401605"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+246+05401605"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+246+05401605"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+246+05401605"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15-1.module_el8.6.0+2904+f21ad6f4"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15-1.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25-1.module_el8.5.0+246+05401605"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25-1.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.1.2-1.16.13.1.3.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.1.2-1.16.13.1.3.module_el8.5.0+246+05401605"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+254+b4526b16"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+254+b4526b16"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+254+b4526b16"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+254+b4526b16"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15-1.module_el8.6.0+2904+f21ad6f4"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15-1.module_el8.5.0+2605+45d748af"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15-1.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.15-1.14.18.2.2.module_el8.5.0+254+b4526b16"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.19-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.11.0-1.16.16.0.1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.5-tuxcare.0"},{"fixed":"1.3.5-tuxcare.2"}]}],"versions":["1.3.5","1.3.5-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.3-tuxcare.0"},{"fixed":"1.3.3-tuxcare.1"}]}],"versions":["1.3.3"]},{"source":"osv","ecosystem":"Debian:12","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1+deb9u1"}]}],"versions":["1.1.0-1"]},{"source":"osv","ecosystem":"npm","package":"ini","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.6"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"nodejs-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.11-1.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.11-1.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.15.4-2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-14.15.4.2.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.20.1-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-12.20.1.1.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-10.23.1.2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.20.1-1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+9715+1718613f"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.15.4-2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+6519+9f98ed83"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.14.15.4.2.module+el8.3.0+9635+ffdf8381"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-5.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.14-14.17.5.1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-5.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.14-12.22.5.1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.5.0+10992+fac5fe06"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.module+el8.4.0+13503+fc29810b"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.module+el8.5.0+13504+a2e74d91"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.11.0-1.16.16.0.1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+721+4c107270"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.module+el8.5.0+721+4c107270"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.6.0+1046+80feca58"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.5.0+702+221f14e6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+733+de4fee6c"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.module+el8.5.0+721+4c107270"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Root:npm","package":"ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-1","1.3.4-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.1-2","3.0.1-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-ini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.1-2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"ini_project","product":"ini"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-INI-1048974","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.npmjs.com/advisories/1589","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qqgx-2p2h-9c37"},{"url":"https://errata.almalinux.org/8/ALSA-2021-0548.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-15095","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-15366","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7608","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7754","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7774","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7788","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8116","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8252","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8265","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8287","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-0549.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2018-3750","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-10746","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-10747","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-0551.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-8277","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-5171.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-28469","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22959","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22960","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-33502","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3807","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3918","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-0350.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-37701","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-37712","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6595","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28469","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33502","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3807","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29244","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32212","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32213","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32214","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32215","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-33987","tags":["report"]},{"url":"https://bugzilla.redhat.com/1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/1964461","tags":["report"]},{"url":"https://bugzilla.redhat.com/2007557","tags":["report"]},{"url":"https://bugzilla.redhat.com/2098556","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102001","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105422","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105426","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105428","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105430","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-6595.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-7788","tags":["advisory"]},{"url":"https://github.com/npm/ini","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0068.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27901","tags":["report"]},{"url":"https://www.debian.org/lts/security/2020/dla-2503","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1769","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15095","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3918","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0421","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898680","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912863","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0421.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7754","tags":["advisory"]},{"url":"https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7774","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7774","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-Y18N-1021887","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8265","tags":["advisory"]},{"url":"https://hackerone.com/reports/988103","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8277","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8277","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8287","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8287","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15366","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-AJV-584908","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0485","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795475","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795479","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0485.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578246","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3750","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3750","tags":["advisory"]},{"url":"https://hackerone.com/reports/311333","tags":["article"]},{"url":"https://nodesecurity.io/advisories/612","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10746","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10746","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10746","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10747","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10747","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0521","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1840004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879315","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0521.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7608","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7608","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8116","tags":["advisory"]},{"url":"https://hackerone.com/reports/719856","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8252","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15095","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0548","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0548.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0549","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0549.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0551","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0551.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3280","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993039","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3280.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28469","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3672","tags":["advisory"]},{"url":"https://c-ares.haxx.se/adv_20210810.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22930","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22931","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22931","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22939","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22940","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22940","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23343","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23343","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32803","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32804","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3281","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3281.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:5171","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014057","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024702","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5171.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3807","tags":["advisory"]},{"url":"https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3918","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22959","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22959","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22960","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22960","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22960","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33502","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0246","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999739","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0246.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37701","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37701","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37701","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc","tags":["article"]},{"url":"https://www.npmjs.com/advisories/1779","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37712","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p","tags":["article"]},{"url":"https://www.npmjs.com/advisories/1780","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0350","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0350.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2098556","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124299","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6595.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29244","tags":["advisory"]},{"url":"https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32212","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32213","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32214","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32215","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-33987","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-33987","tags":["advisory"]},{"url":"https://github.com/sindresorhus/got/pull/2047","tags":["article"]},{"url":"https://github.com/sindresorhus/got/releases/tag/v11.8.5","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0548","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0549","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0551","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:5171","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:0350","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:6595","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-7788","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-7788","title":"Prototype Pollution","description":"This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.","status":"published","published":"2020-12-11T10:45:14.077Z","modified":"2026-10-08T21:13:48.353Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:58.331892Z"}],"euvd":[{"id":"EUVD-2020-1502","description":"This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.","status":"published","published":"2020-12-11T10:45:14Z","modified":"2026-10-08T21:13:48Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P","level":"high"}],"updated_at":"2026-11-02T17:27:26.856493Z"}],"ghsa":[{"id":"GHSA-qqgx-2p2h-9c37","title":"ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse","description":"### Overview\nThe `ini` npm package before version 1.3.6 has a Prototype Pollution vulnerability.\n\nIf an attacker submits a malicious INI file to an application that parses it with `ini.parse`, they will pollute the prototype on the application. This can be exploited further depending on the context.\n\n### Patches\n\nThis has been patched in 1.3.6.\n\n### Steps to reproduce\n\npayload.ini\n```\n[__proto__]\npolluted = \"polluted\"\n```\n\npoc.js:\n```\nvar fs = require('fs')\nvar ini = require('ini')\n\nvar parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8'))\nconsole.log(parsed)\nconsole.log(parsed.__proto__)\nconsole.log(polluted)\n```\n\n```\n\u003e node poc.js\n{}\n{ polluted: 'polluted' }\n{ polluted: 'polluted' }\npolluted\n```","status":"published","published":"2020-12-10T16:53:45Z","modified":"2023-08-31T23:39:55Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2020-7788","description":"This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.","status":"published","published":"2020-12-11T11:15:11.447Z","modified":"2026-10-08T22:17:03.403Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:06:27.10541Z"}],"osv":[{"id":"AZL-44679","title":"CVE-2020-7788 affecting package js-jquery 3.5.0-4","description":"This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.","status":"published","published":"2020-12-11T11:15:11Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"AZL-45153","title":"CVE-2020-7788 affecting package nodejs-nodemon 2.0.3-5","description":"This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.","status":"published","published":"2020-12-11T11:15:11Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2020-7788","description":"This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.","status":"published","published":"2020-12-11T11:15:11.447Z","modified":"2026-10-24T10:50:06.877625905Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"DEBIAN-CVE-2020-7788","description":"This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.","status":"published","published":"2020-12-11T11:15:11.447Z","modified":"2026-10-26T12:02:45.821643278Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-qqgx-2p2h-9c37","title":"ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse","description":"### Overview\nThe `ini` npm package before version 1.3.6 has a Prototype Pollution vulnerability.\n\nIf an attacker submits a malicious INI file to an application that parses it with `ini.parse`, they will pollute the prototype on the application. This can be exploited further depending on the context.\n\n### Patches\n\nThis has been patched in 1.3.6.\n\n### Steps to reproduce\n\npayload.ini\n```\n[__proto__]\npolluted = \"polluted\"\n```\n\npoc.js:\n```\nvar fs = require('fs')\nvar ini = require('ini')\n\nvar parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8'))\nconsole.log(parsed)\nconsole.log(parsed.__proto__)\nconsole.log(polluted)\n```\n\n```\n\u003e node poc.js\n{}\n{ polluted: 'polluted' }\n{ polluted: 'polluted' }\npolluted\n```","status":"published","published":"2020-12-10T16:53:45Z","modified":"2026-09-10T03:49:13.836088947Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"OESA-2022-1769","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\r\n\r\nVersions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \u0026quot;\u0026lt;protocol\u0026gt;://[\u0026lt;user\u0026gt;[:\u0026lt;password\u0026gt;]@]\u0026lt;hostname\u0026gt;[:\u0026lt;port\u0026gt;][:][/]\u0026lt;path\u0026gt;\u0026quot;. The password value is not redacted and is printed to stdout and also to any generated log files.(CVE-2020-15095)\n\nThis affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require( y18n )(); y18n.setLocale( proto ); y18n.updateLocale({polluted: true}); console.log(polluted); // true(CVE-2020-7774)\n\nThis affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.(CVE-2020-7754)\n\nThis affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.(CVE-2020-7788)\n\njson-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ( Prototype Pollution )(CVE-2021-3918)","status":"published","published":"2022-07-22T11:05:02Z","modified":"2026-08-18T01:16:49.916974922Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2021:0421","title":"Red Hat Security Advisory: rh-nodejs14-nodejs security update","status":"published","published":"2024-09-13T22:43:44Z","modified":"2026-10-13T10:02:07Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0485","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T22:44:36Z","modified":"2026-06-28T10:42:22Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0521","title":"Red Hat Security Advisory: rh-nodejs10-nodejs security update","status":"published","published":"2024-09-13T22:43:33Z","modified":"2026-10-14T10:01:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0548","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T22:43:41Z","modified":"2026-10-14T10:01:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0549","title":"Red Hat Security Advisory: nodejs:12 security update","status":"published","published":"2024-09-13T22:43:49Z","modified":"2026-06-28T10:42:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0551","title":"Red Hat Security Advisory: nodejs:14 security and bug fix update","status":"published","published":"2024-09-13T22:43:56Z","modified":"2026-10-13T10:02:09Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:3280","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update","status":"published","published":"2024-09-13T22:46:18Z","modified":"2026-10-14T10:01:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3281","title":"Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update","status":"published","published":"2024-09-13T22:45:36Z","modified":"2026-10-14T10:01:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:5171","title":"Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update","status":"published","published":"2024-10-21T23:53:13Z","modified":"2026-10-14T10:01:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0246","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-21T23:52:59Z","modified":"2026-10-14T10:01:57Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0350","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-21T23:53:29Z","modified":"2026-10-14T10:01:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:6595","title":"Red Hat Security Advisory: nodejs and nodejs-nodemon security and bug fix update","status":"published","published":"2024-09-16T08:50:27Z","modified":"2026-10-14T10:02:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2021:0548","title":"Moderate: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:15Z","modified":"2026-02-04T20:15:14.123658Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:0549","title":"Moderate: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).\n\nSecurity Fix(es):\n\n* nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)\n\n* nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:29Z","modified":"2026-02-05T12:15:07.1896Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:0551","title":"Moderate: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.15.4).\n\nSecurity Fix(es):\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)","status":"published","published":"2021-02-16T07:34:42Z","modified":"2026-02-04T22:30:04.79773Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:5171","title":"Moderate: nodejs:16 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.13.1), nodejs-nodemon (2.0.15). (BZ#2027610)\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-12-15T19:09:29Z","modified":"2026-02-05T03:15:12.020813Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2022:0350","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027609)\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-02-01T20:08:39Z","modified":"2026-02-05T10:45:09.355718Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2022:6595","title":"Moderate: nodejs and nodejs-nodemon security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)\n\nSecurity Fix(es):\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)\n\n* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)\n\n* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)\n\n* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)\n\n* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)\n\n* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [Rocky Linux-9] (BZ#2121019)\n\n* nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)","status":"published","published":"2022-09-20T11:37:49Z","modified":"2026-02-04T16:15:13.375601Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2020-7788","description":"This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.","status":"published","published":"2020-12-11T11:15:00Z","modified":"2026-10-17T12:56:58.315985287Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"ALSA-2021:0548","title":"Moderate: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:15Z","modified":"2026-10-29T11:00:27.308699758Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:0549","title":"Moderate: nodejs:12 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).\n\nSecurity Fix(es):\n\n* nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)\n\n* nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:29Z","modified":"2026-10-29T11:12:03.862338147Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:0551","title":"Moderate: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.15.4).\n\nSecurity Fix(es):\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS (CVE-2020-8277)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* yarn install crashes with nodejs:14 on aarch64 (BZ#1916465)","status":"published","published":"2021-02-16T07:34:42Z","modified":"2026-10-29T11:00:40.22016781Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:5171","title":"Moderate: nodejs:16 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.13.1), nodejs-nodemon (2.0.15). (BZ#2027610)\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-12-15T19:09:29Z","modified":"2026-10-29T11:00:39.414995114Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2022:0350","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027609)\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-02-01T20:08:39Z","modified":"2026-10-29T11:00:38.319658621Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2022:6595","title":"Moderate: nodejs and nodejs-nodemon security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)\n\nSecurity Fix(es):\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n* nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)\n* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)\n* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)\n* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)\n* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)\n* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [almalinux-9] (BZ#2121019)\n* nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)","status":"published","published":"2022-09-20T00:00:00Z","modified":"2026-10-29T11:31:14.804446972Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2026-1771546204","title":"TuxCare security update for ini (1 CVE)","description":"TuxCare rebuilt ini to address 1 CVE. Fixed in 1.3.5-tuxcare.2.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:47:46.307222452Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1775608289","title":"TuxCare security update for ini (1 CVE)","description":"TuxCare rebuilt ini to address 1 CVE. Fixed in 1.3.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-10-15T09:47:49.665173597Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"DLA-2503-1","title":"node-ini - security update","status":"published","published":"2020-12-21T00:00:00Z","modified":"2026-03-09T01:20:20.422093Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0068","title":"Updated nodejs-ini package fixes a security vulnerability","description":"It was discovered that there was an issue in nodejs-ini, where an application\ncould be exploited by a malicious input file. This affects the package ini\nbefore 1.3.6. If an attacker submits a malicious INI file to an application\nthat parses it with ini.parse, they will pollute the prototype on the\napplication. This can be exploited further depending on the context\n(CVE-2020-7788).\n","status":"published","published":"2021-02-05T11:54:53Z","modified":"2026-04-16T04:43:06.326011576Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"ROOT-APP-NPM-CVE-2020-7788","title":"CVE-2020-7788 in ini - Patched by Root","description":"Root has patched CVE-2020-7788 in the ini package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-03T06:44:53Z","modified":"2026-09-03T09:15:02.081572079Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}