Description
geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HackerOne | geoip-lite-country node module | <1.1.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | geoip-lite-country | < 1.1.4 | 1.1.4 | GHSA-ff29-f57w-2mm3 |