Out-of-bounds Read in npmconf
Summary
GHSA-57cf-349j-352g: Out-of-bounds Read in npmconf. Affects npmconf versions < 2.1.3. Fixed in 2.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The npmconf package is a configuration manager for the npm package manager. It is used to store and retrieve configuration settings for npm. The package is deprecated and should not be used anymore. It is vulnerable to an out-of-bounds read issue in versions prior to 2.1.3 when a typed number is passed as input on Node.js 4.x.
Vulnerability Detail
The vulnerability in npmconf arises from the allocation and writing of uninitialized memory contents when a typed number is provided as input. This can lead to out-of-bounds read access, potentially resulting in information disclosure or a crash. The issue affects versions of npmconf before 2.1.3 on Node.js 4.x.
How To Fix
Latest published version: 2.1.3 as of 23 Oct 2026
npm install npmconf@2.1.3The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The npmconf package has a vulnerability that allows for out-of-bounds read access. It is recommended to update to the latest version and consider alternative configuration storage mechanisms. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for npmconf →
FAQ
npmconf is a configuration manager for the npm package manager. It is used to store and retrieve configuration settings for npm.
The vulnerability can lead to out-of-bounds read access, potentially resulting in information disclosure or a crash.
Versions of npmconf before 2.1.3 are affected.
To fix the vulnerability, update to version 2.1.3 or later of npmconf. Consider switching to another configuration storage mechanism as well.
No specific workaround is mentioned for this vulnerability.
