Skip to content
OpenAdvisories
Critical RHSA-2021:0549 7 CVEs

Red Hat Security Advisory: nodejs:12 security update

Published Sep 13, 2024 · Updated Jun 28, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs 1:12.20.1-1.module+el8.3.0+9503+19cb079c
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-debuginfo 1:12.20.1-1.module+el8.3.0+9503+19cb079c
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-debugsource 1:12.20.1-1.module+el8.3.0+9503+19cb079c
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-devel 1:12.20.1-1.module+el8.3.0+9503+19cb079c
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-docs 1:12.20.1-1.module+el8.3.0+9503+19cb079c
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-full-i18n 1:12.20.1-1.module+el8.3.0+9503+19cb079c
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-nodemon 0:2.0.3-1.module+el8.3.0+9715+1718613f
Red Hat · RHEL 8 enterprise_linux:8::appstream nodejs-packaging 0:17-3.module+el8.1.0+3369+37ae6a45
Red Hat · RHEL 8 enterprise_linux:8::appstream npm 1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c

Vulnerabilities 7

  • Critical 9.8
    CVE-2018-3750

    Prototype Pollution in deep-extend

    The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing p…

    deep-extend node-deep-extend node-deep-extend Debian Ubuntu npm
  • Critical 9.8
    CVE-2019-10746

    Prototype Pollution in mixin-deep

    mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

    mixin-deep node-mixin-deep node-mixin-deep Debian Ubuntu npm
  • Critical 9.8
    CVE-2019-10747

    Prototype Pollution in set-value

    set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.

    set-value node-set-value node-set-value Debian Ubuntu npm
  • High 7.5
    CVE-2020-7754

    Regular Expression Denial of Service (ReDoS)

    This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

    npm-user-validate npm
  • High 7.3
    CVE-2020-7788

    Prototype Pollution

    This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

    js-jquery nodejs-nodemon ini node-ini Debian Ubuntu Azure Linux npm
  • Unscored —
    CVE-2020-8265

    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementat…

    Node.js node nodejs nodejs Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-8287 Public exploit EPSS 16%

    Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for ex…

    Node.js node nodejs nodejs Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1795475
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1795479
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1892430
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1907444
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1912854
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1912863
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0549.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-3750
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1578246
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-3750
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-3750
  • article
    https://hackerone.com/reports/311333
  • article
    https://nodesecurity.io/advisories/612
  • report
    https://access.redhat.com/security/cve/CVE-2019-10746
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-10746
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-10746
  • report
    https://access.redhat.com/security/cve/CVE-2019-10747
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-10747
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-10747
  • report
    https://access.redhat.com/security/cve/CVE-2020-7754
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-7754
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-7754
  • article
    https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p
  • report
    https://access.redhat.com/security/cve/CVE-2020-7788
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-7788
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-7788
  • report
    https://access.redhat.com/security/cve/CVE-2020-8265
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8265
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-8265
  • article
    https://hackerone.com/reports/988103
  • report
    https://access.redhat.com/security/cve/CVE-2020-8287
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-8287
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-8287