Most recent entries from all

ALSA-2020:2848 — Important: nodejs:10 security update

2026-10-02T20:56:18.858258+00:00

Affected: AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

Security Fix(es):

* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)

* nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2021-02868

2026-10-02T20:56:18.858341+00:00

bdu:2021-02868

certfr-2022-avi-767 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

2026-10-02T20:56:18.858360+00:00

certfr-2022-avi-767

cnvd-2020-19556

2026-10-02T20:56:18.858383+00:00

cnvd-2020-19556

EUVD-2026-38033

2026-10-02T20:56:18.858417+00:00

EUVD-2026-38033

fkie_cve-2020-7598

2026-10-02T20:56:18.858443+00:00

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

GHSA-vh95-rmgr-6w4m — Prototype Pollution in minimist

2026-10-02T20:56:18.858465+00:00

Affected: npm: minimist

Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application. This is exploitable if attackers have control over the arguments being passed to `minimist`.

## Recommendation

Upgrade to versions 0.2.1, 1.2.3 or later.

gsd-2020-7598

2026-10-02T20:56:18.858491+00:00

gsd-2020-7598

OESA-2021-1397 — nodejs-minimist security update

2026-10-02T20:56:18.858502+00:00

Affected: openEuler:20.03-LTS-SP1: nodejs-minimist, openEuler:20.03-LTS-SP2: nodejs-minimist

This module is the guts of nodejs-optimist's argument parser without all the fanciful decoration. Security Fix(es): minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.(CVE-2020-7598)

openSUSE-SU-2020:0802-1 — Security update for nodejs8

2026-10-02T20:56:18.858525+00:00

Security update for nodejs8

RHSA-2020:2362 — Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update

2026-10-02T20:56:18.858543+00:00

nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method grafana: information disclosure through world-readable grafana configuration files

SUSE-SU-2020:1568-1 — Security update for nodejs10

2026-10-02T20:56:18.858566+00:00

Security update for nodejs10

UBUNTU-CVE-2020-7598

2026-10-02T20:56:18.858581+00:00

Affected: Ubuntu:16.04:LTS: node-minimist, Ubuntu:18.04:LTS: node-minimist

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.