Skip to content
OpenAdvisories
Unscored USN-4785-1 1 CVE

npm vulnerability

Published Mar 15, 2021 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the npm command-line interface mishandled certain
sensitive information. An attacker could use this vulnerability to collect
authentication information that could be used to impersonate other users.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS npm 3.5.2-0ubuntu4.1.16.04.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS npm 3.5.2-0ubuntu4.1.18.04.1~esm1

Vulnerabilities 1

  • High —
    CVE-2016-3956

    npm Token Leak in npm

    The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive informati…

    npm npm npm Debian Ubuntu npm

References

  • report
    https://ubuntu.com/security/CVE-2016-3956