{"id":"CVE-2021-33502","aliases":["ALSA-2021:5171","ALSA-2022:0350","ALSA-2022:6595","AZL-44850","DEBIAN-CVE-2021-33502","EUVD-2021-1374","GHSA-px4h-xg32-q955","RHSA-2021:2931","RHSA-2021:2932","RHSA-2021:5171","RHSA-2022:0246","RHSA-2022:0350","RHSA-2022:4711","RHSA-2022:6595","RLSA-2021:5171","RLSA-2022:0350","RLSA-2022:6595","UBUNTU-CVE-2021-33502"],"status":"published","title":"ReDoS in normalize-url","description":"The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01705,"percentile":0.77589,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2021-05-24T15:42:34Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"normalize-url","fixed_in":["5.3.1","6.0.1","4.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-got","fixed_in":["11.8.1+~cs53.13.17-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-got","fixed_in":["11.8.1+~cs53.13.17-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-got","fixed_in":["11.8.1+~cs53.13.17-3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"normalize-url","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.3.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"normalize-url","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"normalize-url","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.5.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+246+05401605"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+246+05401605"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+246+05401605"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module_el8.5.0+246+05401605"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15-1.module_el8.6.0+2904+f21ad6f4"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15-1.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25-1.module_el8.5.0+246+05401605"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25-1.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.1.2-1.16.13.1.3.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.1.2-1.16.13.1.3.module_el8.5.0+246+05401605"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+254+b4526b16"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+254+b4526b16"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+254+b4526b16"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module_el8.5.0+254+b4526b16"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15-1.module_el8.6.0+2904+f21ad6f4"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15-1.module_el8.5.0+2605+45d748af"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.15-1.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.15-1.14.18.2.2.module_el8.5.0+254+b4526b16"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.19-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.11.0-1.16.16.0.1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.8.1+~cs53.13.17-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.8.1+~cs53.13.17-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.8.1+~cs53.13.17-3"}]}]},{"source":"osv","ecosystem":"npm","package":"normalize-url","ranges":[{"type":"SEMVER","events":[{"introduced":"4.3.0"},{"fixed":"4.5.1"}]}]},{"source":"osv","ecosystem":"npm","package":"normalize-url","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.3.1"}]}]},{"source":"osv","ecosystem":"npm","package":"normalize-url","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.13-12.22.2.1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.2-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-2.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.13-14.17.2.1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.5.0+10992+fac5fe06"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.module+el8.4.0+13503+fc29810b"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.module+el8.5.0+13504+a2e74d91"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-ui-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.3-1.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-2.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-dbscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-health-check-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-restapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-cinderlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-imageio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-ovirt-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-ovirt-engine-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-vmconsole-proxy-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-tools-backup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-vmconsole-proxy-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-webadmin-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"python3-ovirt-engine-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"rhvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0.7-0.9.el8ev"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.11.0-1.16.16.0.1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.13.1-3.module+el8.5.0+721+4c107270"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.module+el8.5.0+721+4c107270"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.6.0+1046+80feca58"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.5.0+702+221f14e6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.18.2-2.module+el8.5.0+733+de4fee6c"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.module+el8.5.0+721+4c107270"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.0-1build1","1.13.0-3","1.19.1-1","1.22.4-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.8.1+~cs53.13.17-3","11.8.2+~cs58.7.32-2","11.8.3+~cs58.7.37-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.10+~cs22.25.14-3","1.22.10+~cs22.25.14-4","1.22.10+~cs22.25.14-5","1.22.10+~cs22.25.14-8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.8.5+~cs58.13.36-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.19+~cs24.27.18-2","1.22.19+~cs24.27.18-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.8.5+~cs58.13.36-5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.2+dfsg-3","4.1.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.8.5+~cs58.13.36-6","11.8.5+~cs58.13.36-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg-1","4.1.0+dfsg-6ubuntu2","4.1.0+dfsg-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.8.5+~cs58.13.36-5","11.8.5+~cs58.13.36-6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0+dfsg-1"]}],"products":[{"vendor":"normalize-url_project","product":"normalize-url"}],"references":[{"url":"https://github.com/sindresorhus/normalize-url/releases/tag/v6.0.1","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20210706-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33502","tags":["web","advisory"]},{"url":"https://github.com/sindresorhus/normalize-url/commit/b1fdb5120b6d27a88400d8800e67ff5a22bd2103","tags":["web"]},{"url":"https://github.com/advisories/GHSA-px4h-xg32-q955"},{"url":"https://errata.almalinux.org/8/ALSA-2021-5171.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-28469","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-7788","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22959","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22960","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-33502","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3807","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3918","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-0350.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-37701","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-37712","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6595","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28469","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33502","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3807","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29244","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32212","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32213","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32214","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32215","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-33987","tags":["report"]},{"url":"https://bugzilla.redhat.com/1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/1964461","tags":["report"]},{"url":"https://bugzilla.redhat.com/2007557","tags":["report"]},{"url":"https://bugzilla.redhat.com/2098556","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102001","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105422","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105426","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105428","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105430","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-6595.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-33502","tags":["advisory"]},{"url":"https://github.com/sindresorhus/normalize-url","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20210706-0001","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2931","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1942592","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979338","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2931.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22918","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23362","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-27290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27290","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33502","tags":["advisory","report"]},{"url":"https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2932","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1942591","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2932.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:5171","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014057","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024702","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5171.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28469","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3807","tags":["advisory"]},{"url":"https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3918","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22959","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22959","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22960","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22960","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22960","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0246","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999739","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0246.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37701","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37701","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37701","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc","tags":["article"]},{"url":"https://www.npmjs.com/advisories/1779","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37712","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p","tags":["article"]},{"url":"https://www.npmjs.com/advisories/1780","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0350","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0350.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:4711","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=655153","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=977778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1624015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1648985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1687845","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1781241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1782056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1849169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1878930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1926625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1927985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959186","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1971622","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1974741","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979797","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980192","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1986726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1986834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1987121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990462","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1991240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995793","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1996123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998255","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000031","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2002283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2003883","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2003996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2008798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010203","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010903","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2019144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2019148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2019153","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2021217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2023250","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2023786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025936","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030663","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2031027","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2035051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037115","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2037121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040402","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040474","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2041544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048546","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050566","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2052690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2054756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061904","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2071468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072637","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2075352","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4711.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23425","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23425","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-TRIMOFFNEWLINES-1296850","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41182","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41183","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41183","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41184","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41184","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41184","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2098556","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124299","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6595.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29244","tags":["advisory"]},{"url":"https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32212","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32213","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32214","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32215","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-33987","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-33987","tags":["advisory"]},{"url":"https://github.com/sindresorhus/got/pull/2047","tags":["article"]},{"url":"https://github.com/sindresorhus/got/releases/tag/v11.8.5","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2021:5171","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:0350","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:6595","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-33502","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-33502","description":"The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.","status":"published","published":"2021-05-24T15:42:34Z","modified":"2024-08-03T23:50:43.171Z","updated_at":"2026-11-02T14:33:10.555814Z"}],"euvd":[{"id":"EUVD-2021-1374","description":"The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.","status":"published","published":"2021-05-24T15:42:34Z","modified":"2024-08-03T23:50:43Z","updated_at":"2026-11-03T03:24:34.304953Z"}],"ghsa":[{"id":"GHSA-px4h-xg32-q955","title":"ReDoS in normalize-url","description":"The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.","status":"published","published":"2021-06-08T23:11:43Z","modified":"2023-11-29T22:10:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2021-33502","description":"The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.","status":"published","published":"2021-05-24T16:15:08.133Z","modified":"2026-06-17T03:54:41.273Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"AZL-44850","title":"CVE-2021-33502 affecting package nodejs-nodemon 2.0.3-5","description":"The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.","status":"published","published":"2021-05-24T16:15:08Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2021-33502","description":"The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.","status":"published","published":"2021-05-24T16:15:08.133Z","modified":"2026-10-20T10:54:44.92330848Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-33502","description":"The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.","status":"published","published":"2021-05-24T16:15:08.133Z","modified":"2026-10-23T18:03:29.560824888Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"GHSA-px4h-xg32-q955","title":"ReDoS in normalize-url","description":"The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.","status":"published","published":"2021-06-08T23:11:43Z","modified":"2023-11-08T04:06:04.745015Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"RHSA-2021:2931","title":"Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update","status":"published","published":"2024-09-13T20:29:20Z","modified":"2026-10-14T10:01:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:2932","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update","status":"published","published":"2024-09-13T20:29:29Z","modified":"2026-10-14T10:01:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:5171","title":"Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update","status":"published","published":"2024-10-21T23:53:13Z","modified":"2026-10-14T10:01:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0246","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-21T23:52:59Z","modified":"2026-10-14T10:01:57Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0350","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-21T23:53:29Z","modified":"2026-10-14T10:01:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:4711","title":"Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.0] security update","status":"published","published":"2024-09-16T06:52:10Z","modified":"2026-10-14T10:02:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6595","title":"Red Hat Security Advisory: nodejs and nodejs-nodemon security and bug fix update","status":"published","published":"2024-09-16T08:50:27Z","modified":"2026-10-14T10:02:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2021:5171","title":"Moderate: nodejs:16 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.13.1), nodejs-nodemon (2.0.15). (BZ#2027610)\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-12-15T19:09:29Z","modified":"2026-02-05T03:15:12.020813Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2022:0350","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027609)\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-02-01T20:08:39Z","modified":"2026-02-05T10:45:09.355718Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2022:6595","title":"Moderate: nodejs and nodejs-nodemon security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)\n\nSecurity Fix(es):\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)\n\n* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)\n\n* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)\n\n* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)\n\n* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)\n\n* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [Rocky Linux-9] (BZ#2121019)\n\n* nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)","status":"published","published":"2022-09-20T11:37:49Z","modified":"2026-02-04T16:15:13.375601Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-33502","description":"The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.","status":"published","published":"2021-05-24T16:15:00Z","modified":"2026-10-17T12:56:19.693578066Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"ALSA-2021:5171","title":"Moderate: nodejs:16 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.13.1), nodejs-nodemon (2.0.15). (BZ#2027610)\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-12-15T19:09:29Z","modified":"2026-10-29T11:00:39.414995114Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2022:0350","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027609)\n\nSecurity Fix(es):\n\n* nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)\n\n* nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)\n\n* llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)\n\n* llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-02-01T20:08:39Z","modified":"2026-10-29T11:00:38.319658621Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2022:6595","title":"Moderate: nodejs and nodejs-nodemon security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)\n\nSecurity Fix(es):\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n* nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)\n* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)\n* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)\n* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)\n* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)\n* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [almalinux-9] (BZ#2121019)\n* nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)","status":"published","published":"2022-09-20T00:00:00Z","modified":"2026-10-29T11:31:14.804446972Z","updated_at":"2026-11-02T15:27:51.655726Z"}]}}