RHSA-2021:0551MediumCVSS 8.1

Red Hat Security Advisory: nodejs:14 security and bug fix update

Published
February 16, 2021
Last Modified
November 5, 2026

🔗 CVE IDs covered (7)

CVE-2020-8287 →CVE-2020-15366 →CVE-2020-7754 →CVE-2020-7774 →CVE-2020-7788 →CVE-2020-8265 →CVE-2020-8277 →

📋 Description

CVE-2020-7754 — nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS CVE-2020-7774 — nodejs-y18n: prototype pollution vulnerability CVE-2020-7788 — nodejs-ini: Prototype pollution via malicious INI file CVE-2020-8265 — nodejs: use-after-free in the TLS implementation CVE-2020-8277 — c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS CVE-2020-8287 — nodejs: HTTP request smuggling via two copies of a header field in an http request CVE-2020-15366 — nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

🎯 Affected products31

  • Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.aarch64 (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.ppc64le (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.s390x (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.src (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.x86_64 (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.aarch64 (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.ppc64le (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.s390x (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debuginfo-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.x86_64 (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.aarch64 (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.ppc64le (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.s390x (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-debugsource-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.x86_64 (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.aarch64 (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.ppc64le (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.s390x (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-devel-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.x86_64 (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-docs-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.noarch (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.aarch64 (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.ppc64le (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.s390x (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-full-i18n-1:14.15.4-2.module+el8.3.0+9635+ffdf8381.x86_64 (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:2.0.3-1.module+el8.3.0+6519+9f98ed83.noarch (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-nodemon-0:2.0.3-1.module+el8.3.0+6519+9f98ed83.src (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.noarch (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nodejs-packaging-0:23-3.module+el8.3.0+6519+9f98ed83.src (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:6.14.10-1.14.15.4.2.module+el8.3.0+9635+ffdf8381.aarch64 (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:6.14.10-1.14.15.4.2.module+el8.3.0+9635+ffdf8381.ppc64le (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • npm-1:6.14.10-1.14.15.4.2.module+el8.3.0+9635+ffdf8381.s390x (nodejs:14) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +1 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (10)