RHSA-2021:0548MediumCVSS 8.1

Red Hat Security Advisory: nodejs:10 security update

Published
February 16, 2021
Last Modified
October 30, 2026

🔗 CVE IDs covered (10)

CVE-2020-8265 →CVE-2020-7608 →CVE-2020-7774 →CVE-2020-8116 →CVE-2020-8287 →CVE-2020-15095 →CVE-2020-15366 →CVE-2020-7754 →CVE-2020-7788 →CVE-2020-8252 →

📋 Description

CVE-2020-7608 — nodejs-yargs-parser: prototype pollution vulnerability CVE-2020-7754 — nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS CVE-2020-7774 — nodejs-y18n: prototype pollution vulnerability CVE-2020-7788 — nodejs-ini: Prototype pollution via malicious INI file CVE-2020-8116 — nodejs-dot-prop: prototype pollution CVE-2020-8252 — libuv: buffer overflow in realpath CVE-2020-8265 — nodejs: use-after-free in the TLS implementation CVE-2020-8287 — nodejs: HTTP request smuggling via two copies of a header field in an http request CVE-2020-15095 — npm: sensitive information exposure through logs CVE-2020-15366 — nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

🎯 Affected products31

  • Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.src (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-docs-1:10.23.1-1.module+el8.3.0+9502+012d8a97.noarch (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.aarch64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.ppc64le (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.s390x (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:10.23.1-1.module+el8.3.0+9502+012d8a97.x86_64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.noarch (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:1.18.3-1.module+el8+2632+6c5111ed.src (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.noarch (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:17-3.module+el8+2873+aa7dfd9a.src (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.aarch64 (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.ppc64le (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97.s390x (nodejs:10) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +1 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.

🔗 References (13)