{"id":"CVE-2021-23362","aliases":["ALSA-2021:3073","ALSA-2021:3074","AZL-44058","CLSA-2026-1773015270","CLSA-2026-1782954031","DEBIAN-CVE-2021-23362","EUVD-2021-0928","GHSA-43f8-2h32-f4cj","MGASA-2021-0372","OESA-2021-1168","RHSA-2021:2931","RHSA-2021:2932","RHSA-2021:3073","RHSA-2021:3074","RHSA-2021:3638","RHSA-2021:3639","RLSA-2021:3073","RLSA-2021:3074","SUSE-SU-2021:2319-1","SUSE-SU-2021:2323-1","SUSE-SU-2021:2326-1","SUSE-SU-2021:2327-1","SUSE-SU-2021:2353-1","SUSE-SU-2021:2354-1","SUSE-SU-2021:2618-1","SUSE-SU-2021:2620-1","UBUNTU-CVE-2021-23362","USN-5216-1","openSUSE-SU-2021:1059-1","openSUSE-SU-2021:1060-1","openSUSE-SU-2021:1061-1","openSUSE-SU-2021:1113-1","openSUSE-SU-2021:2327-1","openSUSE-SU-2021:2353-1","openSUSE-SU-2021:2354-1","openSUSE-SU-2021:2618-1"],"status":"published","title":"Regular Expression Denial of Service (ReDoS)","description":"The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03612,"percentile":0.89583,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2021-03-23T16:20:14Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"hosted-git-info","fixed_in":["3.0.8","2.8.9"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"hosted-git-info","fixed_in":["2.7.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-hosted-git-info","fixed_in":["3.0.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-hosted-git-info","fixed_in":["3.0.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-hosted-git-info","fixed_in":["3.0.8-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-hosted-git-info","fixed_in":["2.1.4-2.oe1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-hosted-git-info","fixed_in":["2.5.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-hosted-git-info","fixed_in":["2.8.5-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"hosted-git-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"hosted-git-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.5.0+254+b4526b16"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"hosted-git-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1-tuxcare.0"},{"fixed":"2.7.1-tuxcare.1"}]}],"versions":["2.7.1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-hosted-git-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-hosted-git-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-hosted-git-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-1"}]}]},{"source":"osv","ecosystem":"npm","package":"hosted-git-info","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.9"}]}]},{"source":"osv","ecosystem":"npm","package":"hosted-git-info","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.3-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs-hosted-git-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-2.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.13-12.22.2.1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.13-14.17.2.1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.3-2.module+el8.4.0+11732+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.3-2.module+el8.4.0+11732+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.3-2.module+el8.4.0+11732+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.3-2.module+el8.4.0+11732+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.3-2.module+el8.4.0+11732+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.3-2.module+el8.4.0+11732+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+11732+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.13-1.12.22.3.2.module+el8.4.0+11732+c668cc9f"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.3-2.module+el8.4.0+11738+3bd42762"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.3-2.module+el8.4.0+11738+3bd42762"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.3-2.module+el8.4.0+11738+3bd42762"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.3-2.module+el8.4.0+11738+3bd42762"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.3-2.module+el8.4.0+11738+3bd42762"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.3-2.module+el8.4.0+11738+3bd42762"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+6519+9f98ed83"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.13-1.14.17.3.2.module+el8.4.0+11738+3bd42762"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.3-2.module+el8.4.0+638+5344c6f7"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.3-2.module+el8.4.0+639+18660d0d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.2-6.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.39.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.2-1.32.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.2-4.16.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.2-4.16.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.2-5.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.2-5.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.12.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0-3.2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-3.47.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-hosted-git-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1ubuntu0.1~esm1"}]}],"versions":["2.1.5-1","2.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-hosted-git-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-1ubuntu0.1~esm1"}]}],"versions":["2.7.1-1","2.8.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-hosted-git-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1ubuntu0.1~esm1"}]}],"versions":["2.1.5-1","2.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-hosted-git-info","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-1ubuntu0.1~esm1"}]}],"versions":["2.7.1-1","2.8.5-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.2-lp152.3.15.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.2-lp152.11.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-lp152.2.15.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-lp152.3.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.2-4.16.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.36.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.2-5.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-10.12.2"}]}],"bundled":3}],"products":[{"vendor":"npmjs","product":"hosted-git-info"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1088356","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f81a4a908eba3","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/npm/hosted-git-info/commits/v2","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/npm/hosted-git-info/commit/29adfe5ef789784c861b2cdeb15051ec2ba651a7","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/npm/hosted-git-info/commit/8d4b3697d79bcd89cdb36d1db165e3696c783a01","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23362","tags":["web","advisory"]},{"url":"https://github.com/npm/hosted-git-info/pull/76","tags":["web"]},{"url":"https://github.com/advisories/GHSA-43f8-2h32-f4cj"},{"url":"https://errata.almalinux.org/8/ALSA-2021-3073.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-22918","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-23362","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-27290","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-3074.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23362","tags":["advisory"]},{"url":"https://github.com/npm/hosted-git-info","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0372.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29028","tags":["report"]},{"url":"https://nodejs.org/en/blog/release/v14.17.0/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v14.17.1/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v14.17.2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v14.17.3/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/","tags":["web","article"]},{"url":"https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v14.16.1/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TE6GHYMCD4SLCPTFPANLIYWCPHXC4G5T/","tags":["web"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1168","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2931","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1942592","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979338","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2931.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22918","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23362","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-27290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27290","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33502","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2932","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1942591","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2932.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3073","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3073.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3074","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3074.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3638","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993928","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3638.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3672","tags":["advisory"]},{"url":"https://c-ares.haxx.se/adv_20210810.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22930","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22931","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22931","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22939","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22940","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22940","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23343","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23343","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32803","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32804","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3639","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993929","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3639.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3073","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3074","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212319-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184450","tags":["report"]},{"url":"https://bugzilla.suse.com/1187973","tags":["report"]},{"url":"https://bugzilla.suse.com/1187976","tags":["report"]},{"url":"https://bugzilla.suse.com/1187977","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27290","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212323-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183155","tags":["report"]},{"url":"https://bugzilla.suse.com/1183851","tags":["report"]},{"url":"https://bugzilla.suse.com/1183852","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3450","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212326-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212327-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212353-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212354-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212618-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212620-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182620","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22884","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-23362","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5216-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4ZO2DR7PIGZWRPXIGYAZCAL4X64BSDZJ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OF3JILGLPQ2UFZS55L7Z33X7S4K562O7/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SR22RRAXGLDTLSDJRAQ4O3Q67G2PNEGJ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QQFKBXOTTNWYS2GOQXWGPFT7H3TPVQVC/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OFQOZ4RLN343RY5DDFVA2KWFMZHZD2KS/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SVLFLECFVPSHO4SQBVWDO2CBAU5LB7IS/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DYHLAI3M6J7NTEFF5DUEXHFHPTDMGRCD/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KZHYVND24KFSRRA7YPSSI2T72HICGJ3Z/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-23362","title":"Regular Expression Denial of Service (ReDoS)","description":"The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.","status":"published","published":"2021-03-23T16:20:14.854Z","modified":"2024-09-17T03:02:03.337Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-0928","description":"The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.","status":"published","published":"2021-03-23T16:20:14Z","modified":"2024-09-17T03:02:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-03T00:28:35.481673Z"}],"ghsa":[{"id":"GHSA-43f8-2h32-f4cj","title":"Regular Expression Denial of Service in hosted-git-info","description":"The npm package `hosted-git-info` before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity","status":"published","published":"2021-05-06T16:10:39Z","modified":"2023-02-01T05:05:20Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:36:33.613868Z"}],"nvd":[{"id":"CVE-2021-23362","description":"The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.","status":"published","published":"2021-03-23T17:15:14.027Z","modified":"2026-06-17T03:38:37.5Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"AZL-44058","title":"CVE-2021-23362 affecting package js-jquery 3.5.0-4","description":"The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.","status":"published","published":"2021-03-23T17:15:14Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2021-23362","description":"The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.","status":"published","published":"2021-03-23T17:15:14.027Z","modified":"2026-10-20T10:54:32.278297143Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-23362","description":"The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.","status":"published","published":"2021-03-23T17:15:14.027Z","modified":"2026-10-23T18:03:37.303393113Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-43f8-2h32-f4cj","title":"Regular Expression Denial of Service in hosted-git-info","description":"The npm package `hosted-git-info` before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity","status":"published","published":"2021-05-06T16:10:39Z","modified":"2025-01-14T08:57:25.609462Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"OESA-2021-1168","title":"nodejs-hosted-git-info security update","description":"Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab\r\n\r\nSecurity Fix(es):\r\n\r\nThe package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.(CVE-2021-23362)","status":"published","published":"2021-05-06T11:04:24Z","modified":"2026-08-18T01:15:31.007627936Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:2931","title":"Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update","status":"published","published":"2024-09-13T20:29:20Z","modified":"2026-10-14T10:01:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:2932","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update","status":"published","published":"2024-09-13T20:29:29Z","modified":"2026-10-14T10:01:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3073","title":"Red Hat Security Advisory: nodejs:12 security, bug fix, and enhancement update","status":"published","published":"2024-09-13T20:29:50Z","modified":"2026-10-14T10:01:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3074","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-09-13T20:29:13Z","modified":"2026-10-14T10:01:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3638","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:52:56Z","modified":"2026-10-14T10:01:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3639","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:53:03Z","modified":"2026-10-14T10:01:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:3073","title":"Moderate: nodejs:12 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.22.3). (BZ#1978201)\n\nSecurity Fix(es):\n\n* nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)\n\n* nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)\n\n* libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-08-10T12:00:47Z","modified":"2026-02-04T11:00:07.646694Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:3074","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.17.3). (BZ#1978203)\n\nSecurity Fix(es):\n\n* nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)\n\n* nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)\n\n* libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-08-10T12:00:51Z","modified":"2026-02-04T09:30:11.353194Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-23362","description":"The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.","status":"published","published":"2021-03-23T17:15:00Z","modified":"2026-02-04T04:32:22.342371Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"ALSA-2021:3073","title":"Moderate: nodejs:12 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (12.22.3). (BZ#1978201)\n\nSecurity Fix(es):\n\n* nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)\n\n* nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)\n\n* libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-08-10T12:00:47Z","modified":"2026-10-29T11:01:23.442252978Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:3074","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.17.3). (BZ#1978203)\n\nSecurity Fix(es):\n\n* nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)\n\n* nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)\n\n* libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-08-10T12:00:51Z","modified":"2026-10-29T11:01:26.684662503Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1773015270","title":"TuxCare security update for hosted-git-info (1 CVE)","description":"TuxCare rebuilt hosted-git-info to address 1 CVE. Fixed in 2.1.4-tuxcare.1.","status":"withdrawn","published":"2026-08-04T14:52:11Z","modified":"2026-10-16T19:00:02.131517091Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1782954031","title":"TuxCare security update for hosted-git-info (1 CVE)","description":"TuxCare rebuilt hosted-git-info to address 1 CVE. Fixed in 2.7.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:41Z","modified":"2026-10-15T09:47:51.615870132Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"MGASA-2021-0372","title":"Updated nodejs packages fix security vulnerabilities","description":"This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix:\nconst y18n = require('y18n')();\ny18n.setLocale('__proto__'); y18n.updateLocale({polluted: true});\nconsole.log(polluted); // true (CVE-2020-7774).\n\nThe package hosted-git-info before 3.0.8 are vulnerable to Regular Expression\nDenial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl\nfunction in index.js. The affected regular expression exhibits polynomial\nworst-case time complexity (CVE-2021-23362).\n\nssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression\nwhich is vulnerable to a denial of service. Malicious SRIs could take an\nextremely long time to process, leading to denial of service. This issue only\naffects consumers using the strict option (CVE-2021-27290).\n\nTheses issues are fixed by upgrading nodejs packages to latest available\nLTS 14.17.3 version. See upstream releases notes for other included bugfixes.\n","status":"published","published":"2021-07-25T14:45:06Z","modified":"2026-04-16T04:43:46.666010956Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:1059-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- update to 12.22.2:\n- CVE-2021-22918: Out of bounds read (bsc#1187973)\n- CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)\n- CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-07-19T21:03:47Z","modified":"2026-02-04T03:36:33.643807Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1060-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\nUpdate nodejs14 to 14.17.2.\n\nIncluding fixes for:\n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-07-19T21:03:51Z","modified":"2026-02-04T03:13:28.709768Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1061-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\nUpdate nodejs10 to 10.24.1.\n\nIncluding fixes for \n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- reduce memory footprint of test-worker-stdio (bsc#1183155)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-07-19T21:03:56Z","modified":"2026-02-04T03:25:11.06458Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1113-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- update to npm 6.14.13\n- CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)\n- CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977)\n- CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-08-09T22:41:17Z","modified":"2026-02-04T04:07:33.250989Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:2327-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- update to 12.22.2:\n- CVE-2021-22918: Out of bounds read (bsc#1187973)\n- CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)\n- CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)\n","status":"published","published":"2021-07-14T15:08:18Z","modified":"2026-02-04T03:39:08.248368Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2353-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\nUpdate nodejs10 to 10.24.1.\n\nIncluding fixes for \n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- reduce memory footprint of test-worker-stdio (bsc#1183155)\n","status":"published","published":"2021-07-15T13:18:04Z","modified":"2026-02-04T04:29:59.542005Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2354-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\nUpdate nodejs14 to 14.17.2.\n\nIncluding fixes for:\n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n","status":"published","published":"2021-07-15T13:19:02Z","modified":"2026-02-04T04:00:00.176756Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2618-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- update to npm 6.14.13\n- CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)\n- CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977)\n- CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450)\n","status":"published","published":"2021-08-05T08:28:09Z","modified":"2026-02-04T03:36:36.287805Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:2319-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\nUpdate nodejs14 to 14.17.2.\n\nIncluding fixes for:\n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n","status":"published","published":"2021-07-14T14:51:28Z","modified":"2026-02-04T02:38:30.088337Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2323-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\nUpdate nodejs10 to 10.24.1.\n\nIncluding fixes for \n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n","status":"published","published":"2021-07-14T15:04:31Z","modified":"2026-02-04T04:29:24.406914Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2326-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- update to 12.22.2:\n- CVE-2021-22918: Out of bounds read (bsc#1187973)\n- CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)\n- CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)\n","status":"published","published":"2021-07-14T15:07:58Z","modified":"2026-02-04T02:45:57.457347Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2327-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- update to 12.22.2:\n- CVE-2021-22918: Out of bounds read (bsc#1187973)\n- CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)\n- CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)\n","status":"published","published":"2021-07-14T15:08:17Z","modified":"2026-02-04T04:38:49.641996Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2353-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\nUpdate nodejs10 to 10.24.1.\n\nIncluding fixes for \n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n- CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)\n- CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)\n- reduce memory footprint of test-worker-stdio (bsc#1183155)\n","status":"published","published":"2021-07-15T13:18:32Z","modified":"2026-02-04T04:22:58.524075Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2354-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\nUpdate nodejs14 to 14.17.2.\n\nIncluding fixes for:\n\n- CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)\n- CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)\n- CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)\n","status":"published","published":"2021-07-15T13:19:01Z","modified":"2026-02-04T03:43:46.364934Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2618-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- update to npm 6.14.13\n- CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)\n- CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977)\n- CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450)\n","status":"published","published":"2021-08-05T08:28:03Z","modified":"2026-02-04T02:44:19.56497Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2620-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- update to npm 6.14.13\n- CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976)\n- CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service (bsc#1187977)\n- CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)\n","status":"published","published":"2021-08-05T08:36:27Z","modified":"2026-02-04T03:00:31.807562Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-5216-1","title":"node-hosted-git-info vulnerability","description":"It was discovered that hosted-git-info incorrectly handled certain inputs. A\nremote attacker could use this to cause a denial of service.\n","status":"published","published":"2022-09-02T05:01:08Z","modified":"2026-02-10T04:42:25Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}