Skip to content
OpenAdvisories
High RLSA-2022:4796 1 CVE

Important: nodejs:16 security update

Published May 30, 2022 · Updated Feb 4, 2026

Ecosystem: Rocky Linux

Summary

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* npm: npm ci succeeds when package-lock.json doesn't match package.json (CVE-2021-43616)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
Rocky Linux · 8 nodejs 1:16.14.0-4.module+el8.6.0+978+59f26232
Rocky Linux · 8 nodejs-nodemon 0:2.0.15-1.module+el8.5.0+721+4c107270
Rocky Linux · 8 nodejs-packaging 0:25-1.module+el8.6.0+1046+80feca58
Rocky Linux · 8 nodejs-packaging 0:25-1.module+el8.5.0+702+221f14e6

Vulnerabilities 1

  • Critical 9.0
    CVE-2021-43616 Public exploit

    The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in pac…

    npm npm npm Debian Ubuntu Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2050282