Skip to content
OpenAdvisories
High ALSA-2022:4796 1 CVE

Important: nodejs:16 security update

Published May 30, 2022 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* npm: npm ci succeeds when package-lock.json doesn't match package.json (CVE-2021-43616)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 9

ReleasePackageFixed in
AlmaLinux · 8 nodejs 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4
AlmaLinux · 8 nodejs-devel 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4
AlmaLinux · 8 nodejs-docs 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4
AlmaLinux · 8 nodejs-full-i18n 1:16.14.0-4.module_el8.6.0+2904+f21ad6f4
AlmaLinux · 8 nodejs-nodemon 2.0.15-1.module_el8.6.0+2904+f21ad6f4
AlmaLinux · 8 nodejs-nodemon 2.0.15-1.module_el8.5.0+2605+45d748af
AlmaLinux · 8 nodejs-packaging 25-1.module_el8.5.0+246+05401605
AlmaLinux · 8 nodejs-packaging 25-1.module_el8.5.0+2605+45d748af
AlmaLinux · 8 npm 1:8.3.1-1.16.14.0.4.module_el8.6.0+2904+f21ad6f4

Vulnerabilities 1

  • Critical 9.0
    CVE-2021-43616 Public exploit

    The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in pac…

    npm npm npm Debian Ubuntu Alpine

References

  • report
    https://vulners.com/cve/CVE-2021-43616