{"id":"CVE-2022-29244","aliases":["ALSA-2022:6595","EUVD-2022-6068","GHSA-hj9c-8jmm-8c52","RHSA-2022:6595","RLSA-2022:6595","SUSE-SU-2022:3196-1","SUSE-SU-2022:3250-1","SUSE-SU-2022:3251-1","UBUNTU-CVE-2022-29244","openSUSE-SU-2024:12280-1"],"status":"published","title":"npm packing does not respect root-level ignore files in workspaces","description":"npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=\u003cname\u003e`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.04004,"percentile":0.90673,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2022-06-02T15:37:27Z","modified":"2026-10-29T11:31:14Z","fixes":[{"ecosystem":"npm","package":"npm","fixed_in":["8.11.0"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nodejs16","fixed_in":["16.17.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.9.0"},{"fixed":"8.11.0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.19-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.11.0-1.16.16.0.1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"npm","package":"npm","ranges":[{"type":"SEMVER","events":[{"introduced":"7.9.0"},{"fixed":"8.11.0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.11.0-1.16.16.0.1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-8.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-150400.3.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.18~dfsg-3","1.3.10~dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.21+ds-2","3.5.2-0ubuntu4","3.5.2-0ubuntu4.1.16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.2-0ubuntu4","3.5.2-0ubuntu4.1.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0+ds6-4","6.14.4+ds-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.5.2+ds-2","7.24.2+ds-1","7.24.2+ds-2","8.3.0~ds-1","8.3.0~ds-2","8.3.2~ds-1","8.5.0~ds-1","8.5.1~ds-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.0~ds1-1","9.2.0~ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.0~ds1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.0~ds3-1","11.16.0+ds2-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.0~ds1-3","9.2.0~ds2-2","9.2.0~ds3-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.17.0-1.1"}]}]}],"products":[{"vendor":"netapp","product":"ontap_select_deploy_administration_utility"},{"vendor":"npm","product":"npm"},{"vendor":"npmjs","product":"npm"}],"references":[{"url":"https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","article","report"]},{"url":"https://github.com/npm/npm-packlist","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","package","web","report"]},{"url":"https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","web","report"]},{"url":"https://github.com/npm/cli/tree/latest/workspaces/libnpmpack","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","web","report"]},{"url":"https://github.com/nodejs/node/pull/43210","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/npm/cli/releases/tag/v8.11.0","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://github.com/nodejs/node/releases/tag/v16.15.1","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://github.com/nodejs/node/releases/tag/v17.9.1","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://github.com/nodejs/node/releases/tag/v18.3.0","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20220722-0007/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29244","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hj9c-8jmm-8c52"},{"url":"https://access.redhat.com/errata/RHSA-2022:6595","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28469","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33502","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3807","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29244","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32212","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32213","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32214","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32215","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-33987","tags":["report"]},{"url":"https://bugzilla.redhat.com/1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/1964461","tags":["report"]},{"url":"https://bugzilla.redhat.com/2007557","tags":["report"]},{"url":"https://bugzilla.redhat.com/2098556","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102001","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105422","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105426","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105428","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105430","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-6595.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29244.json","tags":["advisory"]},{"url":"https://github.com/npm/cli","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20220722-0007","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2098556","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124299","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6595.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28469","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3807","tags":["advisory"]},{"url":"https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33502","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29244","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32212","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32213","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32214","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32215","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-33987","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-33987","tags":["advisory"]},{"url":"https://github.com/sindresorhus/got/pull/2047","tags":["article"]},{"url":"https://github.com/sindresorhus/got/releases/tag/v11.8.5","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2022:6595","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223196-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200303","tags":["report"]},{"url":"https://bugzilla.suse.com/1200517","tags":["report"]},{"url":"https://bugzilla.suse.com/1201710","tags":["report"]},{"url":"https://bugzilla.suse.com/1202382","tags":["report"]},{"url":"https://bugzilla.suse.com/1202383","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35949","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223250-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223251-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-29244","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-29244","title":"npm packing does not respect root-level ignore files in workspaces","description":"npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=\u003cname\u003e`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.","status":"published","published":"2022-06-13T13:40:27Z","modified":"2025-04-23T16:23:31.058Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:36.578327Z"}],"euvd":[{"id":"EUVD-2022-6068","description":"npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=\u003cname\u003e`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.","status":"published","published":"2022-06-13T13:40:27Z","modified":"2025-04-23T16:23:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:12.74685Z"}],"ghsa":[{"id":"GHSA-hj9c-8jmm-8c52","title":"Packing does not respect root-level ignore files in workspaces","description":"### Impact\n`npm pack` ignores root-level `.gitignore` \u0026 `.npmignore` file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=\u003cname\u003e`). Anyone who has run `npm pack` or `npm publish` with workspaces, as of [v7.9.0](https://github.com/npm/cli/releases/tag/v7.9.0) \u0026 [v7.13.0](https://github.com/npm/cli/releases/tag/v7.13.0) respectively, may be affected and have published files into the npm registry they did not intend to include.\n\n### Patch\n- Upgrade to the latest, patched version of `npm` ([`v8.11.0`](https://github.com/npm/cli/releases/tag/v8.11.0) or greater), run: `npm i -g npm@latest`\n- Node.js versions [`v16.15.1`](https://github.com/nodejs/node/releases/tag/v16.15.1), [`v17.19.1`](https://github.com/nodejs/node/releases/tag/v17.9.1) \u0026 [`v18.3.0`](https://github.com/nodejs/node/releases/tag/v18.3.0) include the patched `v8.11.0` version of `npm`\n\n#### Steps to take to see if you're impacted\n1. Run `npm publish --dry-run` or `npm pack` with an `npm` version `\u003e=7.9.0` \u0026 `\u003c8.11.0` inside the project's root directory using a workspace flag like: `--workspaces` or `--workspace=\u003cname\u003e` (ex. `npm pack --workspace=foo`)\n2. Check the output in your terminal which will list the package contents (note: `tar -tvf \u003cpackage-on-disk\u003e` also works)\n3. If you find that there are files included you did not expect, you should:\n  3.1. Create \u0026 publish a new release excluding those files (ref. [\"Keeping files out of your Package\"](https://docs.npmjs.com/cli/v8/using-npm/developers#keeping-files-out-of-your-package))\n  3.2. Deprecate the old package (ex. `npm deprecate \u003cpkg\u003e[@\u003cversion\u003e] \u003cmessage\u003e`)\n  3.3. Revoke or rotate any sensitive information (ex. passwords, tokens, secrets etc.) which might have been exposed\n### References\n- [CVE-2022-29244](https://nvd.nist.gov/vuln/detail/CVE-2022-29244)\n- [`npm-packlist`](https://github.com/npm/npm-packlist)\n- [`libnpmpack`](https://github.com/npm/cli/tree/latest/workspaces/libnpmpack)\n- [`libnpmpublish`](https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish)","status":"published","published":"2022-06-02T15:37:27Z","modified":"2023-01-27T05:03:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:20.985872Z"}],"nvd":[{"id":"CVE-2022-29244","description":"npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=\u003cname\u003e`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.","status":"published","published":"2022-06-13T14:15:09.027Z","modified":"2026-06-17T04:39:54.333Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:07:22.232533Z"}],"osv":[{"id":"CVE-2022-29244","title":"npm packing does not respect root-level ignore files in workspaces","description":"npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=\u003cname\u003e`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.","status":"published","published":"2022-06-13T13:40:27Z","modified":"2026-10-28T02:30:37.859856252Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"GHSA-hj9c-8jmm-8c52","title":"Packing does not respect root-level ignore files in workspaces","description":"### Impact\n`npm pack` ignores root-level `.gitignore` \u0026 `.npmignore` file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=\u003cname\u003e`). Anyone who has run `npm pack` or `npm publish` with workspaces, as of [v7.9.0](https://github.com/npm/cli/releases/tag/v7.9.0) \u0026 [v7.13.0](https://github.com/npm/cli/releases/tag/v7.13.0) respectively, may be affected and have published files into the npm registry they did not intend to include.\n\n### Patch\n- Upgrade to the latest, patched version of `npm` ([`v8.11.0`](https://github.com/npm/cli/releases/tag/v8.11.0) or greater), run: `npm i -g npm@latest`\n- Node.js versions [`v16.15.1`](https://github.com/nodejs/node/releases/tag/v16.15.1), [`v17.19.1`](https://github.com/nodejs/node/releases/tag/v17.9.1) \u0026 [`v18.3.0`](https://github.com/nodejs/node/releases/tag/v18.3.0) include the patched `v8.11.0` version of `npm`\n\n#### Steps to take to see if you're impacted\n1. Run `npm publish --dry-run` or `npm pack` with an `npm` version `\u003e=7.9.0` \u0026 `\u003c8.11.0` inside the project's root directory using a workspace flag like: `--workspaces` or `--workspace=\u003cname\u003e` (ex. `npm pack --workspace=foo`)\n2. Check the output in your terminal which will list the package contents (note: `tar -tvf \u003cpackage-on-disk\u003e` also works)\n3. If you find that there are files included you did not expect, you should:\n  3.1. Create \u0026 publish a new release excluding those files (ref. [\"Keeping files out of your Package\"](https://docs.npmjs.com/cli/v8/using-npm/developers#keeping-files-out-of-your-package))\n  3.2. Deprecate the old package (ex. `npm deprecate \u003cpkg\u003e[@\u003cversion\u003e] \u003cmessage\u003e`)\n  3.3. Revoke or rotate any sensitive information (ex. passwords, tokens, secrets etc.) which might have been exposed\n### References\n- [CVE-2022-29244](https://nvd.nist.gov/vuln/detail/CVE-2022-29244)\n- [`npm-packlist`](https://github.com/npm/npm-packlist)\n- [`libnpmpack`](https://github.com/npm/cli/tree/latest/workspaces/libnpmpack)\n- [`libnpmpublish`](https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish)","status":"published","published":"2022-06-02T15:37:27Z","modified":"2023-11-08T04:09:11.980528Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"RHSA-2022:6595","title":"Red Hat Security Advisory: nodejs and nodejs-nodemon security and bug fix update","status":"published","published":"2024-09-16T08:50:27Z","modified":"2026-10-14T10:02:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:6595","title":"Moderate: nodejs and nodejs-nodemon security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)\n\nSecurity Fix(es):\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)\n\n* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)\n\n* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)\n\n* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)\n\n* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)\n\n* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [Rocky Linux-9] (BZ#2121019)\n\n* nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)","status":"published","published":"2022-09-20T11:37:49Z","modified":"2026-02-04T16:15:13.375601Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-29244","description":"npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=\u003cname\u003e`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.","status":"published","published":"2022-06-13T14:15:00Z","modified":"2026-10-17T12:56:21.804095657Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"ALSA-2022:6595","title":"Moderate: nodejs and nodejs-nodemon security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)\n\nSecurity Fix(es):\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n* nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)\n* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)\n* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)\n* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)\n* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)\n* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [almalinux-9] (BZ#2121019)\n* nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)","status":"published","published":"2022-09-20T00:00:00Z","modified":"2026-10-29T11:31:14.804446972Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"openSUSE-SU-2024:12280-1","title":"corepack16-16.17.0-1.1 on GA media","description":"These are all security issues fixed in the corepack16-16.17.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:35:41.70508Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:3196-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).\n- CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).\n- CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).\n- CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).\n\nBugfixes:\n\n- Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)\n","status":"published","published":"2022-09-08T08:35:42Z","modified":"2026-02-04T04:06:40.438354Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:3250-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).\n- CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).\n- CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).\n- CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).\n\nBugfixes:\n\n- Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)\n","status":"published","published":"2022-09-12T07:06:54Z","modified":"2026-02-04T04:01:38.008685Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"SUSE-SU-2022:3251-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).\n- CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).\n- CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).\n- CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).\n\nBugfixes:\n\n- Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)\n","status":"published","published":"2022-09-12T07:07:06Z","modified":"2026-02-04T04:04:13.518338Z","updated_at":"2026-11-02T15:53:50.965375Z"}]}}