{"kind": "product", "path": "vulns/alpine-v3.12/nodejs", "name": "nodejs", "product": "nodejs", "ecosystem": "Alpine:v3.12", "items": [{"id": "ALPINE-CVE-2022-21824", "noindex": false, "published": "2022-02-24T19:15:10.080Z", "modified": "2026-10-15T07:17:54.160326439Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2022-21824", "title": "ALPINE-CVE-2022-21824", "description": "Due to the formatting logic of the \"console.table()\" function it was not safe to allow user controlled input to be passed to the \"properties\" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be \"__proto__\". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.", "references": ["https://security.alpinelinux.org/vuln/CVE-2022-21824", "https://osv.dev/vulnerability/ALPINE-CVE-2022-21824"], "fixes": ["12.22.10-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-44533", "noindex": false, "published": "2022-02-24T19:15:09.407Z", "modified": "2026-10-23T17:17:56.226333028Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-44533", "title": "ALPINE-CVE-2021-44533", "description": "Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerab", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-44533", "https://osv.dev/vulnerability/ALPINE-CVE-2021-44533"], "fixes": ["12.22.10-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-44532", "noindex": false, "published": "2022-02-24T19:15:09.360Z", "modified": "2026-10-23T17:17:56.226254375Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-44532", "title": "ALPINE-CVE-2021-44532", "description": "Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-44532", "https://osv.dev/vulnerability/ALPINE-CVE-2021-44532"], "fixes": ["12.22.10-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-44531", "noindex": false, "published": "2022-02-24T19:15:09.313Z", "modified": "2026-10-23T17:17:56.225491326Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-44531", "title": "ALPINE-CVE-2021-44531", "description": "Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-44531", "https://osv.dev/vulnerability/ALPINE-CVE-2021-44531"], "fixes": ["12.22.10-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-3672", "noindex": false, "published": "2021-11-23T19:15:07.877Z", "modified": "2026-10-23T17:17:56.201696333Z", "cvss": 5.6, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-3672", "title": "ALPINE-CVE-2021-3672", "description": "A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-3672", "https://osv.dev/vulnerability/ALPINE-CVE-2021-3672"], "fixes": ["12.22.5-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-22959", "noindex": false, "published": "2021-11-15T15:15:06.747Z", "modified": "2026-10-23T17:17:56.154883678Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-22959", "title": "ALPINE-CVE-2021-22959", "description": "The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-22959", "https://osv.dev/vulnerability/ALPINE-CVE-2021-22959"], "fixes": ["12.22.10-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-22960", "noindex": false, "published": "2021-11-03T20:15:08.247Z", "modified": "2026-10-23T17:17:56.155070199Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-22960", "title": "ALPINE-CVE-2021-22960", "description": "The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-22960", "https://osv.dev/vulnerability/ALPINE-CVE-2021-22960"], "fixes": ["12.22.10-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-22930", "noindex": false, "published": "2021-10-07T14:15:08.053Z", "modified": "2026-10-23T17:17:56.153967784Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-22930", "title": "ALPINE-CVE-2021-22930", "description": "Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-22930", "https://osv.dev/vulnerability/ALPINE-CVE-2021-22930"], "fixes": ["12.22.4-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-39135", "noindex": false, "published": "2021-08-31T17:15:08.207Z", "modified": "2026-10-23T17:17:56.206949132Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-39135", "title": "ALPINE-CVE-2021-39135", "description": "`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained wit", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-39135", "https://osv.dev/vulnerability/ALPINE-CVE-2021-39135"], "fixes": ["12.22.6-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-39134", "noindex": false, "published": "2021-08-31T17:15:08.147Z", "modified": "2026-10-23T17:17:56.206858413Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-39134", "title": "ALPINE-CVE-2021-39134", "description": "`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies differ only in the case of their name, Arborist's internal data structure saw them as separate items that could coexist w", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-39134", "https://osv.dev/vulnerability/ALPINE-CVE-2021-39134"], "fixes": ["12.22.6-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-37713", "noindex": false, "published": "2021-08-31T17:15:08.087Z", "modified": "2026-10-23T17:17:56.204750672Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-37713", "title": "ALPINE-CVE-2021-37713", "description": "The npm package \"tar\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specif", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-37713", "https://osv.dev/vulnerability/ALPINE-CVE-2021-37713"], "fixes": ["12.22.6-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-37712", "noindex": false, "published": "2021-08-31T17:15:08.023Z", "modified": "2026-10-23T17:17:56.204488247Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-37712", "title": "ALPINE-CVE-2021-37712", "description": "The npm package \"tar\" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values ", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-37712", "https://osv.dev/vulnerability/ALPINE-CVE-2021-37712"], "fixes": ["12.22.6-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-37701", "noindex": false, "published": "2021-08-31T17:15:07.963Z", "modified": "2026-10-23T17:17:56.204278856Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-37701", "title": "ALPINE-CVE-2021-37701", "description": "The npm package \"tar\" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, w", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-37701", "https://osv.dev/vulnerability/ALPINE-CVE-2021-37701"], "fixes": ["12.22.6-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-22939", "noindex": false, "published": "2021-08-16T19:15:13.897Z", "modified": "2026-10-23T17:17:56.154075667Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-22939", "title": "ALPINE-CVE-2021-22939", "description": "If the Node.js https API was used incorrectly and \"undefined\" was in passed for the \"rejectUnauthorized\" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-22939", "https://osv.dev/vulnerability/ALPINE-CVE-2021-22939"], "fixes": ["12.22.5-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-22931", "noindex": false, "published": "2021-08-16T19:15:13.127Z", "modified": "2026-10-23T17:17:56.154076602Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-22931", "title": "ALPINE-CVE-2021-22931", "description": "Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-22931", "https://osv.dev/vulnerability/ALPINE-CVE-2021-22931"], "fixes": ["12.22.5-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-22918", "noindex": false, "published": "2021-07-12T11:15:07.937Z", "modified": "2026-10-23T17:17:56.152317623Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-22918", "title": "ALPINE-CVE-2021-22918", "description": "Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-22918", "https://osv.dev/vulnerability/ALPINE-CVE-2021-22918"], "fixes": ["12.22.2-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-22884", "noindex": false, "published": "2021-03-03T18:15:14.957Z", "modified": "2026-10-23T17:17:56.150167855Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-22884", "title": "ALPINE-CVE-2021-22884", "description": "Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-22884", "https://osv.dev/vulnerability/ALPINE-CVE-2021-22884"], "fixes": ["12.21.0-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2021-22883", "noindex": false, "published": "2021-03-03T18:15:14.893Z", "modified": "2026-10-23T17:17:56.150082664Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2021-22883", "title": "ALPINE-CVE-2021-22883", "description": "Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.", "references": ["https://security.alpinelinux.org/vuln/CVE-2021-22883", "https://osv.dev/vulnerability/ALPINE-CVE-2021-22883"], "fixes": ["12.21.0-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2020-8287", "noindex": false, "published": "2021-01-06T21:15:14.707Z", "modified": "2026-09-11T10:17:51.451644050Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2020-8287", "title": "ALPINE-CVE-2020-8287", "description": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.", "references": ["https://security.alpinelinux.org/vuln/CVE-2020-8287", "https://osv.dev/vulnerability/ALPINE-CVE-2020-8287"], "fixes": ["12.20.1-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}, {"id": "ALPINE-CVE-2020-8265", "noindex": false, "published": "2021-01-06T21:15:14.410Z", "modified": "2026-09-11T10:17:51.450352733Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2020-8265", "title": "ALPINE-CVE-2020-8265", "description": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.", "references": ["https://security.alpinelinux.org/vuln/CVE-2020-8265", "https://osv.dev/vulnerability/ALPINE-CVE-2020-8265"], "fixes": ["12.20.1-r0"], "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}]}], "total": 55, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "nodejs", "path": "vulns/alpine-v3.12/nodejs", "ecosystem": "Alpine:v3.12"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-23T17:17:56.226333028Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}