npm vulnerabilities (AlmaLinux)
175 vulnerabilities.
npmAlmaLinuxThe permission model protects itself against path traversal attacks by calling path.resolve() on...7.9 HighnpmAlmaLinuxA vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP...7.5 HighnpmAlmaLinuxOn Linux, Node.js ignores certain environment variables if those may have been set by an...7.5 HighnpmAlmaLinuxVarious `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In...9.8 CriticalnpmAlmaLinuxA previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit...7.7 HighnpmAlmaLinuxMaliciously crafted export names in an imported WebAssembly module can inject JavaScript code....5.3 MediumnpmAlmaLinuxWhen the Node.js policy feature checks the integrity of a resource against a trusted manifest,...7.5 HighnpmAlmaLinuxUndici's cookie header not cleared on cross-origin redirect in fetch3.9 LownpmAlmaLinuxA privilege escalation vulnerability exists in the experimental policy mechanism in all active...7.5 HighnpmAlmaLinuxThe use of `module.constructor.createRequire()` can bypass the policy mechanism and require...8.8 HighnpmAlmaLinuxThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the...9.8 CriticalnpmAlmaLinuxEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.5 HighnpmAlmaLinuxThe generateKeys() API function returned from crypto.createDiffieHellman() only generates missing...7.5 HighnpmAlmaLinuxllhttp vulnerable to HTTP request smuggling7.5 HighnpmAlmaLinuxWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate...5.3 MediumnpmAlmaLinuxThe use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism...7.5 HighnpmAlmaLinuxsemver vulnerable to Regular Expression Denial of Service5.3 MediumnpmAlmaLinux0-byte UDP payload DoS in c-ares7.5 HighnpmAlmaLinuxInsufficient randomness in generation of DNS query IDs in c-ares5.9 MediumnpmAlmaLinuxBuffer Underwrite in ares_inet_net_pton()4.1 MediumnpmAlmaLinuxAutoTools does not set CARES_RANDOM_FILE during cross compilation3.7 LownpmAlmaLinuxAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21...4.2 MediumnpmAlmaLinuxA cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...7.5 HighnpmAlmaLinuxA privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3...7.5 HighnpmAlmaLinuxCRLF Injection in Nodejs ‘undici’ via host6.5 MediumnpmAlmaLinuxUndici vulnerable to Regular Expression Denial of Service in Headers7.5 HighnpmAlmaLinuxA flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the...8.6 HighnpmAlmaLinuxhttp-cache-semantics vulnerable to Regular Expression Denial of Service5.3 MediumnpmAlmaLinuxdecode-uri-component vulnerable to Denial of Service (DoS)7.5 HighnpmAlmaLinuxqs vulnerable to Prototype Pollution7.5 HighnpmAlmaLinuxA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19...8.1 HighnpmAlmaLinuxminimatch ReDoS vulnerability7.5 HighnpmAlmaLinuxA weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with...9.1 CriticalnpmAlmaLinuxThe llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that...6.5 MediumnpmAlmaLinuxglob-parent 6.0.0 vulnerable to Regular Expression Denial of Service7.5 HighnpmAlmaLinuxThe llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line...6.5 MediumnpmAlmaLinuxllhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields6.5 MediumnpmAlmaLinuxllhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding6.5 MediumnpmAlmaLinuxA OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due...8.1 HighnpmAlmaLinuxGot allows a redirect to a UNIX socket5.3 MediumnpmAlmaLinuxnpm packing does not respect root-level ignore files in workspaces7.5 HighnpmAlmaLinuxPrototype Pollution in minimist9.8 CriticalnpmAlmaLinuxDue to the formatting logic of the "console.table()" function it was not safe to allow user...8.2 HighnpmAlmaLinuxModerate: nodejs:14 security update5.3 MediumnpmAlmaLinuxNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...5.3 MediumnpmAlmaLinuxAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...7.4 HighnpmAlmaLinuxExposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch8.8 HighnpmAlmaLinuxThe parser in accepts requests with a space (SP) right after the header name before the colon....6.5 MediumnpmAlmaLinuxThe npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if...9.0 CriticalnpmAlmaLinuxPrototype Pollution in kriszyp/json-schema9.8 Critical- Show moreLoading…