Most recent entries from all

ALSA-2022:9073 — Moderate: nodejs:16 security, bug fix, and enhancement update

Affected: AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: npm

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).

Security Fix(es):

* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531) * nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532) * nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533) * minimist: prototype pollution (CVE-2021-44906) * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517) * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548) * nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [almalinux-8] (BZ#2151625)

bdu:2024-01534

certfr-2022-avi-767 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2022-avi-767

cnvd-2022-25210

EUVD-2026-33159

fkie_cve-2021-44906

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

GHSA-xvch-5gv4-984h — Prototype Pollution in minimist

Affected: npm: minimist

Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file `index.js`, function `setKey()` (lines 69-95).

gsd-2021-44906

NCSC-2026-0325 — Kwetsbaarheden verholpen in Atlassian producten

NCSC-2026-0325

OESA-2022-1665 — nodejs-minimist security update

Affected: openEuler:20.03-LTS-SP1: nodejs-minimist, openEuler:20.03-LTS-SP3: nodejs-minimist, openEuler:22.03-LTS: nodejs-minimist

This module is the guts of optimist's argument parser without all the fanciful decoration.

Security Fix(es):

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).(CVE-2021-44906)

RHSA-2022:1739 — Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.2.1 containers security update

minimist: prototype pollution node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery node-forge: Signature verification leniency in checking `DigestInfo` structure

RHSA-2022:9073 — Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

nodejs: Improper handling of URI Subject Alternative Names nodejs: Certificate Verification Bypass via String Injection nodejs: Incorrect handling of certificate subject and issuer fields minimist: prototype pollution nodejs-minimatch: ReDoS via the braceExpand function nodejs: Prototype pollution via console.table properties nodejs: DNS rebinding in inspect via invalid octal IP address

SUSE-SU-2022:1459-1 — Security update for nodejs14

Security update for nodejs14

UBUNTU-CVE-2021-44906

Affected: Ubuntu:16.04:LTS: node-minimist, Ubuntu:18.04:LTS: node-minimist, Ubuntu:20.04:LTS: node-minimist, Ubuntu:22.04:LTS: node-minimist, Ubuntu:24.04:LTS: node-minimist, Ubuntu:25.10: node-minimist, Ubuntu:26.04:LTS: node-minimist

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

WID-SEC-W-2022-0417 — Red Hat OpenShift Service Mesh: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh ausnutzen, um Dateien zu manipulieren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.