{"id":"CVE-2020-8252","aliases":["ALPINE-CVE-2020-8252","ALSA-2020:4272","ALSA-2021:0548","BELL-CVE-2020-8252","BIT-node-2020-8252","BIT-node-min-2020-8252","DEBIAN-CVE-2020-8252","EUVD-2020-29122","GHSA-c5r6-cm8r-wgh9","MGASA-2020-0372","MGASA-2020-0398","RHSA-2020:4272","RHSA-2020:4903","RHSA-2020:5086","RHSA-2021:0521","RHSA-2021:0548","RLSA-2020:4272","RLSA-2021:0548","SUSE-SU-2020:2812-1","SUSE-SU-2020:2813-1","SUSE-SU-2020:2823-1","SUSE-SU-2020:2829-1","UBUNTU-CVE-2020-8252","USN-4548-1","openSUSE-SU-2020:1616-1","openSUSE-SU-2020:1660-1"],"status":"published","title":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js...","description":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00714,"percentile":0.53979,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2020-09-18T20:11:51Z","modified":"2026-10-29T11:00:27Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"libuv","fixed_in":["1.38.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libuv","fixed_in":["1.39.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libuv","fixed_in":["1.39.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libuv","fixed_in":["1.39.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libuv","fixed_in":["1.39.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libuv","fixed_in":["1.39.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libuv","fixed_in":["1.39.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libuv","fixed_in":["1.39.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libuv","fixed_in":["1.39.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libuv","fixed_in":["1.39.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libuv","fixed_in":["1.39.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libuv","fixed_in":["1.39.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libuv","fixed_in":["1.39.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"nodejs","fixed_in":["12.20.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["12.18.4-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["10.22.1","12.18.4","14.9.0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["10.22.1","12.18.4","14.9.0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libuv1","fixed_in":["1.39.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libuv1","fixed_in":["1.39.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libuv1","fixed_in":["1.39.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"libuv","fixed_in":["1.34.2-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libuv1","fixed_in":["1.34.2-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.20.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":10},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.22.1"},{"introduced":"12.0.0"},{"fixed":"12.18.4"},{"introduced":"14.0.0"},{"fixed":"14.9.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.22.1"},{"introduced":"12.0.0"},{"fixed":"12.18.4"},{"introduced":"14.0.0"},{"fixed":"14.9.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2-1.mga7"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:7","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-9.mga7"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:7","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.18.4-2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.4-3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.4-3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.4-3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.18.4-3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.6-12.18.4.3.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.23.1-2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.10-10.23.1.2.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.23.1-1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-1.20.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-4.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-1.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-1.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-1.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-1.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-1.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-1.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-1.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2-1ubuntu1.1"}]}],"versions":["1.30.1-1","1.33.1-2","1.33.1-2ubuntu2","1.33.1-3ubuntu1","1.34.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libuv1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2-1ubuntu1.1"}]}],"versions":["1.30.1-1","1.33.1-2","1.33.1-2ubuntu2","1.33.1-3ubuntu1","1.34.2-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.18.4-lp152.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-lp152.2.6.1"}]}],"bundled":2}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://hackerone.com/reports/965914","tags":["x_refsource_MISC","x_transferred","Permissions Required","Third Party Advisory","advisory","report"]},{"url":"https://security.gentoo.org/glsa/202009-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4548-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20201009-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8252","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/"},{"url":"https://github.com/advisories/GHSA-c5r6-cm8r-wgh9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-8252","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4272","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1856875","tags":["report"]},{"url":"https://bugzilla.redhat.com/1868196","tags":["report"]},{"url":"https://bugzilla.redhat.com/1879311","tags":["report"]},{"url":"https://bugzilla.redhat.com/1879315","tags":["report"]},{"url":"https://bugzilla.redhat.com/1883966","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-4272.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-15095","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8116","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8201","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8252","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-0548.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-15366","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7608","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7754","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7774","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7788","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8265","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-8287","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-8252","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8252","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0372.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25314","tags":["report"]},{"url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/","tags":["web"]},{"url":"https://github.com/nodejs/node/blob/v10.x/doc/changelogs/CHANGELOG_V10.md","tags":["web"]},{"url":"https://github.com/nghttp2/nghttp2/releases/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2020-0398.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27403","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4548-1","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GRACEATF77QULUT3WY4JG54X5ZI4OUWO/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868196","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879311","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1879315","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883966","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4272.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8116","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8116","tags":["advisory"]},{"url":"https://hackerone.com/reports/719856","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8201","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8252","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15095","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15095","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4903","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883965","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4903.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5086","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5086.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0521","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1840004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1898680","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1912863","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0521.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7608","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7608","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7608","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7754","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7754","tags":["advisory"]},{"url":"https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7774","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7774","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-Y18N-1021887","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8265","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8265","tags":["advisory"]},{"url":"https://hackerone.com/reports/988103","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8287","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8287","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15366","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15366","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-AJV-584908","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0548","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0548.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4272","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:0548","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202812-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172686","tags":["report"]},{"url":"https://bugzilla.suse.com/1173937","tags":["report"]},{"url":"https://bugzilla.suse.com/1176589","tags":["report"]},{"url":"https://bugzilla.suse.com/1176605","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8252","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202813-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202823-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202829-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8252","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/#fs-realpath-native-on-may-cause-buffer-overflow-medium-cve-2020-8252","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5CMPMUA4PV5TIZ4ZIY7PTL3KUZIS2IAM/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NXR3SXX6RCZ7MMPKWBRQP7QGXO4JN25P/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-8252","description":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.","status":"published","published":"2020-09-18T20:11:51Z","modified":"2025-04-30T22:24:26.861Z","cwes":["CWE-120"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2020-29122","description":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.","status":"published","published":"2020-09-18T20:11:51Z","modified":"2025-04-30T22:24:26Z","updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-c5r6-cm8r-wgh9","title":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js...","description":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.","status":"published","published":"2022-05-24T17:29:12Z","modified":"2023-01-29T05:03:57Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:45:26.08688Z"}],"nvd":[{"id":"CVE-2020-8252","description":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.","status":"published","published":"2020-09-18T21:15:13.497Z","modified":"2026-06-17T03:26:08.197Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:06:15.83396Z"}],"osv":[{"id":"ALPINE-CVE-2020-8252","description":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.","status":"published","published":"2020-09-18T21:15:13.497Z","modified":"2026-10-26T11:17:55.183645366Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-8252","title":"CVE-2020-8252 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:50.58977Z","modified":"2026-09-17T07:15:04.662075731Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-8252","description":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.","status":"published","published":"2020-09-18T21:15:13.497Z","modified":"2026-10-24T10:30:42.072493091Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-8252","description":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.","status":"published","published":"2020-09-18T21:15:13.497Z","modified":"2026-10-26T12:02:52.12601571Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"RHSA-2020:4272","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-09-13T22:43:13Z","modified":"2026-10-14T10:01:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:4903","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-09-13T22:43:09Z","modified":"2026-10-14T10:01:35Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5086","title":"Red Hat Security Advisory: rh-nodejs12-nodejs security update","status":"published","published":"2024-09-13T22:43:18Z","modified":"2026-10-14T10:01:38Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2021:0521","title":"Red Hat Security Advisory: rh-nodejs10-nodejs security update","status":"published","published":"2024-09-13T22:43:33Z","modified":"2026-10-14T10:01:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:0548","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-09-13T22:43:41Z","modified":"2026-10-14T10:01:39Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2020:4272","title":"Moderate: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.4).\n\nSecurity Fix(es):\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)\n\n* npm: Sensitive information exposure through logs (CVE-2020-15095)\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* The nodejs:12/development module is not installable (BZ#1883966)","status":"published","published":"2020-10-19T07:13:10Z","modified":"2026-02-04T20:45:08.733821Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:0548","title":"Moderate: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:15Z","modified":"2026-02-04T20:15:14.123658Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-8252","description":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.","status":"published","published":"2020-09-18T21:15:00Z","modified":"2026-04-22T12:44:10.707093Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"ALSA-2020:4272","title":"Moderate: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.18.4).\n\nSecurity Fix(es):\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: HTTP request smuggling due to CR-to-Hyphen conversion (CVE-2020-8201)\n\n* npm: Sensitive information exposure through logs (CVE-2020-15095)\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* The nodejs:12/development module is not installable (BZ#1883966)","status":"published","published":"2020-10-19T07:13:10Z","modified":"2026-10-29T11:00:18.049115126Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:0548","title":"Moderate: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-02-16T07:34:15Z","modified":"2026-10-29T11:00:27.308699758Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-node-2020-8252","description":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.","status":"published","published":"2024-03-06T11:07:50.102Z","modified":"2026-09-08T08:48:17.558258904Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2020-8252","description":"The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.","status":"published","published":"2024-12-16T14:06:45.811Z","modified":"2026-09-08T08:48:16.787315538Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"MGASA-2020-0372","title":"Updated nodejs packages fix security vulnerabilities","description":"The nodejs package has been updated to the latest version in the 10.x branch,\nwhich is 10.22.1 at this time.  It fixes several security issues and other\nbugs.  See the upstream changelog and advisories for details.\n","status":"published","published":"2020-09-27T20:06:37Z","modified":"2026-04-16T04:43:16.918624291Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"MGASA-2020-0398","title":"Updated libuv packages a fix security vulnerability","description":"The implementation of realpath in libuv before 1.39 incorrectly determined the\nbuffer size which can result in a buffer overflow if the resolved path is\nlonger than 256 bytes (CVE-2020-8252).\n","status":"published","published":"2020-11-08T14:14:27Z","modified":"2026-04-16T04:41:11.46574685Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:1616-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- nodejs12 was updated to 12.18.4 LTS:\n   - CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).\n   - CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).\n   - CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation\n  on Aarch64 with gcc10 (bsc#1172686)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-10-05T04:22:45Z","modified":"2026-02-04T03:09:19.93763Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1660-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- nodejs10 was updated to 10.22.1 LTS:\n   - CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).\n   - CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation\n  on Aarch64 with gcc10 (bsc#1172686)\t  \n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-10-12T08:24:04Z","modified":"2026-02-04T04:39:24.000931Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"SUSE-SU-2020:2812-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- nodejs12 was updated to 12.18.4 LTS:\n   - CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).\n   - CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).\n   - CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation\n  on Aarch64 with gcc10 (bsc#1172686)\n","status":"published","published":"2020-10-01T07:54:58Z","modified":"2026-02-04T04:13:15.246325Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2813-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- nodejs12 was updated to 12.18.4 LTS:\n   - CVE-2020-8201: Fixed an HTTP Request Smuggling due to CR-to-Hyphen conversion (bsc#1176605).\n   - CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).\n   - CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation\n  on Aarch64 with gcc10 (bsc#1172686)\n","status":"published","published":"2020-10-01T07:55:11Z","modified":"2026-02-04T03:16:02.725898Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2823-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- nodejs10 was updated to 10.22.1 LTS:\n   - CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).\n   - CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation\n  on Aarch64 with gcc10 (bsc#1172686)\t  \n","status":"published","published":"2020-10-01T12:02:36Z","modified":"2026-02-04T03:52:56.953216Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2829-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- nodejs10 was updated to 10.22.1 LTS:\n   - CVE-2020-8252: Fixed a buffer overflow in realpath (bsc#1176589).\n   - CVE-2020-15095: Fixed an information leak through log files (bsc#1173937).\n- Explicitly add -fno-strict-aliasing to CFLAGS to fix compilation\n  on Aarch64 with gcc10 (bsc#1172686)\t  \n","status":"published","published":"2020-10-02T08:34:15Z","modified":"2025-05-02T04:09:54.271399Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-4548-1","title":"libuv1 vulnerability","description":"It was discovered that libuv incorrectly handled certain paths.\nAn attacker could possibly use this issue to cause a crash or execute\narbitrary code.\n","status":"published","published":"2020-09-28T14:43:13Z","modified":"2026-04-22T10:08:18.160303Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}