{"id":"GHSA-57cf-349j-352g","aliases":[],"status":"published","title":"Out-of-bounds Read in npmconf","description":"Versions of `npmconf` before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x.\n\n\n## Recommendation\n\nUpdate to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-06-12T16:37:00Z","modified":"2023-01-09T05:01:42Z","fixes":[{"ecosystem":"npm","package":"npmconf","fixed_in":["2.1.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"npmconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3"}]}]},{"source":"osv","ecosystem":"npm","package":"npmconf","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.3"}]}]}],"references":[{"url":"https://hackerone.com/reports/320269","tags":["web"]},{"url":"https://www.npmjs.com/advisories/653","tags":["web"]},{"url":"https://github.com/advisories/GHSA-57cf-349j-352g"}],"sources":{"ghsa":[{"id":"GHSA-57cf-349j-352g","title":"Out-of-bounds Read in npmconf","description":"Versions of `npmconf` before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x.\n\n\n## Recommendation\n\nUpdate to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used.","status":"published","published":"2019-06-12T16:37:00Z","modified":"2023-01-09T05:01:42Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"osv":[{"id":"GHSA-57cf-349j-352g","title":"Out-of-bounds Read in npmconf","description":"Versions of `npmconf` before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x.\n\n\n## Recommendation\n\nUpdate to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used.","status":"published","published":"2019-06-12T16:37:00Z","modified":"2020-08-31T18:31:27Z","cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}