Moderate: Vulnerability in nodejs:16
Summary
ALSA-2021:5171: Moderate: nodejs:16 security, bug fix, and enhancement update. Affects nodejs across 2 version ranges.
< 1:16.13.1-3.module_el8.5.0+2605+45d748af
< 1:16.13.1-3.module_el8.5.0+246+05401605
Fixed in 1:16.13.1-3.module_el8.5.0+2605+45d748af or 1:16.13.1-3.module_el8.5.0+246+05401605, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a software development platform that allows developers to build fast and scalable network applications using JavaScript. It is widely used for server-side and networking applications. The vulnerability affects the nodejs package in the AlmaLinux 8 ecosystem.
Vulnerability Detail
The vulnerability (CVE-2021-3918) is related to prototype pollution in the nodejs-json-schema package. Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object and potentially execute arbitrary code. This vulnerability could be exploited by an attacker to manipulate the behavior of the affected application and potentially gain unauthorized access or cause a denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nodejs-
< 1:16.13.1-3.module_el8.5.0+246+054016051:16.13.1-3.module_el8.5.0+246+05401605 -
< 1:16.13.1-3.module_el8.5.0+2605+45d748af1:16.13.1-3.module_el8.5.0+2605+45d748af
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating the package to the latest version is the recommended solution.
Conclusion
The vulnerability in the nodejs package (CVE-2021-3918) can be fixed by updating the package to version 16.13.1 or later. It is important to keep the software up to date to mitigate the risk of exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object and potentially execute arbitrary code. It can lead to unauthorized access or denial of service.
The vulnerability could be exploited by an attacker to manipulate the behavior of the affected application and potentially gain unauthorized access or cause a denial of service.
You can update the nodejs package using the package manager or by following the instructions provided by the package maintainer.
There is no specific workaround mentioned for this vulnerability. Updating the package to the latest version is the recommended solution.
You can find more information about this vulnerability on the CVE page (CVE-2021-3918) listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
