rpm package
almalinux/nodejs-nodemon
pkg:rpm/almalinux/nodejs-nodemon
Vulnerabilities (173)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-43616 | Cri | 9.0 | < 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | Nov 13, 2021 | The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was sup | |
| CVE-2021-3918 | Cri | 9.8 | < 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | Nov 13, 2021 | json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | |
| CVE-2021-22960 | Med | 6.5 | < 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | Nov 3, 2021 | The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. | |
| CVE-2021-22930 | Cri | 9.8 | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f | Oct 7, 2021 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. | |
| CVE-2021-3807 | Hig | 7.5 | < 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | Sep 17, 2021 | ansi-regex is vulnerable to Inefficient Regular Expression Complexity | |
| CVE-2021-37712 | Hig | 8.2 | < 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | Aug 31, 2021 | The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This | |
| CVE-2021-37701 | Hig | 8.2 | < 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | Aug 31, 2021 | The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This i | |
| CVE-2021-22940 | Hig | 7.5 | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f | Aug 16, 2021 | Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. | |
| CVE-2021-22939 | Med | 5.3 | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f | Aug 16, 2021 | If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. | |
| CVE-2021-22931 | Cri | 9.8 | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f | Aug 16, 2021 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacki | |
| CVE-2021-32804 | Hig | 8.2 | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f | Aug 3, 2021 | The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into rel | |
| CVE-2021-32803 | Hig | 8.2 | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f | Aug 3, 2021 | The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not e | |
| CVE-2021-22918 | Med | 5.3 | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f | Jul 12, 2021 | Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. Th | |
| CVE-2020-28469 | Med | 5.3 | < 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | Jun 3, 2021 | This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator. | |
| CVE-2021-33502 | Hig | 7.5 | < 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | 2.0.15-1.module_el8.6.0+2904+f21ad6f4 | May 24, 2021 | The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs. | |
| CVE-2021-23343 | Med | 5.3 | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f | May 4, 2021 | All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity. | |
| CVE-2021-23362 | Med | 5.3 | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f | Mar 23, 2021 | The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity. | |
| CVE-2021-27290 | Hig | 7.5 | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f | Mar 12, 2021 | ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option. | |
| CVE-2021-22884 | Hig | 7.5 | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f | Mar 3, 2021 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker control | |
| CVE-2021-22883 | Hig | 7.5 | < 2.0.3-1.module_el8.4.0+2521+c668cc9f | 2.0.3-1.module_el8.4.0+2521+c668cc9f | Mar 3, 2021 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then th |
- affected < 2.0.15-1.module_el8.6.0+2904+f21ad6f4fixed 2.0.15-1.module_el8.6.0+2904+f21ad6f4
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was sup
- affected < 2.0.15-1.module_el8.6.0+2904+f21ad6f4fixed 2.0.15-1.module_el8.6.0+2904+f21ad6f4
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- affected < 2.0.15-1.module_el8.6.0+2904+f21ad6f4fixed 2.0.15-1.module_el8.6.0+2904+f21ad6f4
The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
- affected < 2.0.3-1.module_el8.4.0+2521+c668cc9ffixed 2.0.3-1.module_el8.4.0+2521+c668cc9f
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
- affected < 2.0.15-1.module_el8.6.0+2904+f21ad6f4fixed 2.0.15-1.module_el8.6.0+2904+f21ad6f4
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
- affected < 2.0.15-1.module_el8.6.0+2904+f21ad6f4fixed 2.0.15-1.module_el8.6.0+2904+f21ad6f4
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This
- affected < 2.0.15-1.module_el8.6.0+2904+f21ad6f4fixed 2.0.15-1.module_el8.6.0+2904+f21ad6f4
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This i
- affected < 2.0.3-1.module_el8.4.0+2521+c668cc9ffixed 2.0.3-1.module_el8.4.0+2521+c668cc9f
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
- affected < 2.0.3-1.module_el8.4.0+2521+c668cc9ffixed 2.0.3-1.module_el8.4.0+2521+c668cc9f
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
- affected < 2.0.3-1.module_el8.4.0+2521+c668cc9ffixed 2.0.3-1.module_el8.4.0+2521+c668cc9f
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacki
- affected < 2.0.3-1.module_el8.4.0+2521+c668cc9ffixed 2.0.3-1.module_el8.4.0+2521+c668cc9f
The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into rel
- affected < 2.0.3-1.module_el8.4.0+2521+c668cc9ffixed 2.0.3-1.module_el8.4.0+2521+c668cc9f
The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not e
- affected < 2.0.3-1.module_el8.4.0+2521+c668cc9ffixed 2.0.3-1.module_el8.4.0+2521+c668cc9f
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. Th
- affected < 2.0.15-1.module_el8.6.0+2904+f21ad6f4fixed 2.0.15-1.module_el8.6.0+2904+f21ad6f4
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
- affected < 2.0.15-1.module_el8.6.0+2904+f21ad6f4fixed 2.0.15-1.module_el8.6.0+2904+f21ad6f4
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
- affected < 2.0.3-1.module_el8.4.0+2521+c668cc9ffixed 2.0.3-1.module_el8.4.0+2521+c668cc9f
All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
- affected < 2.0.3-1.module_el8.4.0+2521+c668cc9ffixed 2.0.3-1.module_el8.4.0+2521+c668cc9f
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
- affected < 2.0.3-1.module_el8.4.0+2521+c668cc9ffixed 2.0.3-1.module_el8.4.0+2521+c668cc9f
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
- affected < 2.0.3-1.module_el8.4.0+2521+c668cc9ffixed 2.0.3-1.module_el8.4.0+2521+c668cc9f
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker control
- affected < 2.0.3-1.module_el8.4.0+2521+c668cc9ffixed 2.0.3-1.module_el8.4.0+2521+c668cc9f
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then th
Page 7 of 9