npm vulnerabilities (Red Hat)
197 vulnerabilities.
npmRed Hatllhttp vulnerable to HTTP request smuggling7.5 HighnpmRed HatWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate...5.3 MediumnpmRed HatThe use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism...7.5 HighnpmRed Hatsemver vulnerable to Regular Expression Denial of Service5.3 MediumnpmRed Hat0-byte UDP payload DoS in c-ares7.5 HighnpmRed HatInsufficient randomness in generation of DNS query IDs in c-ares5.9 MediumnpmRed HatBuffer Underwrite in ares_inet_net_pton()4.1 MediumnpmRed HatAutoTools does not set CARES_RANDOM_FILE during cross compilation3.7 LownpmRed HatAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21...4.2 MediumnpmRed HatA cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...7.5 HighnpmRed HatA privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3...7.5 HighnpmRed HatCRLF Injection in Nodejs ‘undici’ via host6.5 MediumnpmRed HatUndici vulnerable to Regular Expression Denial of Service in Headers7.5 HighnpmRed HatA flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the...8.6 HighnpmRed Hathttp-cache-semantics vulnerable to Regular Expression Denial of Service5.3 MediumnpmRed Hatdecode-uri-component vulnerable to Denial of Service (DoS)7.5 HighnpmRed Hatqs vulnerable to Prototype Pollution7.5 HighnpmRed HatA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19...8.1 HighnpmRed Hatminimatch ReDoS vulnerability7.5 HighnpmRed HatA weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with...9.1 CriticalnpmRed HatThe llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that...6.5 MediumnpmRed Hatglob-parent 6.0.0 vulnerable to Regular Expression Denial of Service7.5 HighnpmRed HatThe llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line...6.5 MediumnpmRed Hatllhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields6.5 MediumnpmRed Hatllhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding6.5 MediumnpmRed HatA OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due...8.1 HighnpmRed HatGot allows a redirect to a UNIX socket5.3 MediumnpmRed Hatnpm packing does not respect root-level ignore files in workspaces7.5 HighnpmRed HatPrototype Pollution in minimist9.8 CriticalnpmRed HatDue to the formatting logic of the "console.table()" function it was not safe to allow user...8.2 HighnpmRed HatModerate: nodejs:14 security update5.3 MediumnpmRed HatNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...5.3 MediumnpmRed HatAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...7.4 HighnpmRed HatExposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch8.8 HighnpmRed HatThe parser in accepts requests with a space (SP) right after the header name before the colon....6.5 MediumnpmRed HatThe npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if...9.0 CriticalnpmRed HatPrototype Pollution in kriszyp/json-schema9.8 CriticalnpmRed HatThe parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body...6.5 MediumnpmRed HatInefficient Regular Expression Complexity in chalk/ansi-regex7.5 HighnpmRed HatArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links8.2 HighnpmRed HatArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links8.2 HighnpmRed HatNode.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an...7.5 HighnpmRed HatIf the Node.js https API was used incorrectly and "undefined" was in passed for the ...5.3 MediumnpmRed HatNode.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS,...9.8 CriticalnpmRed HatA flaw was found in c-ares library, where a missing input validation check of host names returned...5.6 MediumnpmRed HatUse After Free in node.js9.8 CriticalnpmRed HatArbitrary File Creation/Overwrite due to insufficient absolute path sanitization8.2 HighnpmRed HatArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning8.2 HighnpmRed HatOut-of-Bounds Read in Node.js5.3 MediumnpmRed HatRegular Expression Denial of Service (ReDoS)5.3 Medium- Show moreLoading…