{"id":"CVE-2021-44907","aliases":["EUVD-2021-31706","GHSA-rq7c-8f3g-q36h","SUSE-SU-2022:1459-1","SUSE-SU-2022:1461-1","SUSE-SU-2022:1462-1","SUSE-SU-2022:1466-1","SUSE-SU-2022:1694-1","SUSE-SU-2022:1717-1","UBUNTU-CVE-2021-44907"],"status":"rejected","title":"A Denial of Service vulnerability exists in qs up to 6.8.0 due to insufficient sanitization of...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2022-03-17T20:43:10Z","modified":"2026-02-04T04:11:59Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-6.28.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.32.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.19.1-150200.15.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-1.48.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-150200.10.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.17.0-150200.10.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.44.1"}]}],"bundled":9}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44907"},{"url":"https://github.com/ljharb/qs/issues/436","tags":["report"]},{"url":"https://github.com/ljharb/qs/blob/master/dist/qs.js#L670","tags":["report"]},{"url":"https://jsfiddle.net/65jxksay/","tags":["report"]},{"url":"https://jsfiddle.net/pb6an1dy/","tags":["report"]},{"url":"https://github.com/advisories/GHSA-rq7c-8f3g-q36h"},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221459-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194819","tags":["report"]},{"url":"https://bugzilla.suse.com/1196877","tags":["report"]},{"url":"https://bugzilla.suse.com/1197283","tags":["report"]},{"url":"https://bugzilla.suse.com/1198247","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0778","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221461-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221462-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221466-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221694-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221717-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191962","tags":["report"]},{"url":"https://bugzilla.suse.com/1191963","tags":["report"]},{"url":"https://bugzilla.suse.com/1192153","tags":["report"]},{"url":"https://bugzilla.suse.com/1192154","tags":["report"]},{"url":"https://bugzilla.suse.com/1192696","tags":["report"]},{"url":"https://bugzilla.suse.com/1194514","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21824","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-44907","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44907","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-44907","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none","status":"rejected","published":"2022-03-17T20:43:10Z","modified":"2022-04-11T17:43:12Z","updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2021-31706","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none","status":"published","published":"2022-03-17T20:43:10Z","modified":"2022-04-11T17:43:12Z","updated_at":"2026-11-03T03:51:08.805166Z"}],"ghsa":[{"id":"GHSA-rq7c-8f3g-q36h","title":"A Denial of Service vulnerability exists in qs up to 6.8.0 due to insufficient sanitization of...","description":"A Denial of Service vulnerability exists in qs up to 6.8.0 due to insufficient sanitization of property in the gs.parse function. The merge() function allows the assignment of properties on an array in the query. For any property being assigned, a value in the array is converted to an object containing these properties. Essentially, this means that the property whose expected type is Array always has to be checked with Array.isArray() by the user. This may not be obvious to the user and can cause unexpected behavior.","status":"published","published":"2022-03-18T00:01:09Z","modified":"2023-01-27T05:00:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:41:44.80267Z"}],"nvd":[{"id":"CVE-2021-44907","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none","status":"rejected","published":"2022-03-17T21:15:07.947Z","modified":"2023-11-07T03:39:44.46Z","updated_at":"2026-11-02T14:07:05.581807Z"}],"osv":[{"id":"UBUNTU-CVE-2021-44907","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"withdrawn","published":"2022-03-17T21:15:00Z","modified":"2025-07-08T14:32:22.805207Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:30.277322Z"},{"id":"SUSE-SU-2022:1459-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).\n- CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).\n- CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).\n- CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).\n","status":"published","published":"2022-04-28T12:38:04Z","modified":"2026-02-04T03:07:20.551845Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1461-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\t\n- CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).\n- CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).\n- CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).\n- CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).\n","status":"published","published":"2022-04-28T14:25:18Z","modified":"2025-05-02T04:31:59.352321Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1462-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).\n- CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).\n- CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).\n- CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).\n","status":"published","published":"2022-04-28T14:46:29Z","modified":"2026-02-04T03:15:52.359531Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1466-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).\n- CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).\n- CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).\n","status":"published","published":"2022-04-29T09:42:23Z","modified":"2026-02-04T03:50:06.527285Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1694-1","title":"Security update for nodejs8","description":"This update for nodejs8 fixes the following issues:\n\n- CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).\n- CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).\n- CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).\n","status":"published","published":"2022-05-17T07:13:45Z","modified":"2026-02-04T04:11:59.436478Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1717-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).\n- CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).\n- CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).\n- CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).\n- CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).\n- CVE-2022-21824: Fixed prototype pollution via console.table (bsc#1194514).\n- CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).\n- CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).\n- CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).\n","status":"published","published":"2022-05-17T15:43:16Z","modified":"2026-02-04T02:37:21.561016Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}