Skip to content
OpenAdvisories
High RHSA-2021:0548 10 CVEs

Red Hat Security Advisory: nodejs:10 security update

Published Sep 13, 2024 · Updated Oct 14, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs 1:10.23.1-1.module+el8.3.0+9502+012d8a97
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-debuginfo 1:10.23.1-1.module+el8.3.0+9502+012d8a97
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-debugsource 1:10.23.1-1.module+el8.3.0+9502+012d8a97
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-devel 1:10.23.1-1.module+el8.3.0+9502+012d8a97
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-docs 1:10.23.1-1.module+el8.3.0+9502+012d8a97
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-full-i18n 1:10.23.1-1.module+el8.3.0+9502+012d8a97
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-nodemon 0:1.18.3-1.module+el8+2632+6c5111ed
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-packaging 0:17-3.module+el8+2873+aa7dfd9a
Red Hat · RHEL 8 enterprise_linux:8::appstream npm 1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97

Vulnerabilities 10

  • High 7.5
    CVE-2020-7754

    Regular Expression Denial of Service (ReDoS)

    This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

    npm-user-validate npm
  • High 7.3
    CVE-2020-7774 EPSS 70%

    Prototype Pollution

    The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

    nodejs node-y18n node-y18n y18n Debian Ubuntu Alpine npm
  • High 7.3
    CVE-2020-7788

    Prototype Pollution

    This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

    js-jquery nodejs-nodemon ini node-ini Debian Ubuntu Azure Linux npm
  • High 7.3
    CVE-2020-8116

    dot-prop Prototype Pollution vulnerability

    Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

    js-jquery dot-prop node-dot-prop node-dot-prop Debian Ubuntu Azure Linux npm
  • Medium 5.6
    CVE-2020-15366

    Prototype Pollution in Ajv

    An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the wo…

    node-ajv node-ajv ajv Debian Ubuntu npm
  • Medium 5.3
    CVE-2020-7608

    yargs-parser Vulnerable to Prototype Pollution

    yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

    yargs-parser node-yargs-parser node-yargs-parser Debian Ubuntu npm
  • Medium 4.4
    CVE-2020-15095

    Sensitive information exposure through logs in npm cli

    Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is print…

    npm cli npm npm Debian Ubuntu npm
  • Unscored —
    CVE-2020-8252

    The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined t…

    Node.js node nodejs libuv1 Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-8265

    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementat…

    Node.js node nodejs nodejs Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-8287 Public exploit EPSS 16%

    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for ex…

    Node.js node nodejs nodejs Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1840004
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1856875
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1857977
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1868196
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1879315
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1892430
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1898680
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1907444
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1912854
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1912863
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0548.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-7608
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-7608
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-7608
  • report
    https://access.redhat.com/security/cve/CVE-2020-7754
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-7754
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-7754
  • article
    https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p
  • report
    https://access.redhat.com/security/cve/CVE-2020-7774
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-7774
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-7774
  • article
    https://snyk.io/vuln/SNYK-JS-Y18N-1021887
  • report
    https://access.redhat.com/security/cve/CVE-2020-7788
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-7788
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-7788
  • report
    https://access.redhat.com/security/cve/CVE-2020-8116
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8116
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-8116
  • article
    https://hackerone.com/reports/719856
  • report
    https://access.redhat.com/security/cve/CVE-2020-8252
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8252
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-8252
  • report
    https://access.redhat.com/security/cve/CVE-2020-8265
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8265
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-8265
  • article
    https://hackerone.com/reports/988103
  • report
    https://access.redhat.com/security/cve/CVE-2020-8287
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8287