The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Dec 13, 2019 |
| Centos_linux | — | Upgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-devel-debuginfoUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debuginfo | Feb 26, 2020 | Dec 13, 2019 |
| Debian | — | Upgrade npm | Jul 30, 2024 | Dec 13, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jul 3, 2026 | Jul 2, 2026 |
| Freebsd | — | Upgrade npm | Jun 11, 2020 | Jun 10, 2020 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Dec 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-10 to version 10.19.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.17.0-11.4.18.0.1.2.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.18.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Dec 13, 2019 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-develUpgrade npm | Mar 2, 2020 | Dec 12, 2019 |
| Redhat_linux | — | Upgrade nodejs-devel-debuginfoUpgrade nodejsUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-debuginfo | Feb 26, 2020 | Dec 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Dec 13, 2019 |
| Suse | — | Upgrade npm8Upgrade nodejs6Upgrade nodejs12Upgrade nodejs8-develUpgrade nodejs10Upgrade nodejs6-docsUpgrade nodejs6-develUpgrade nodejs10-docsUpgrade nodejs10-develUpgrade nodejs12-docsUpgrade npm6Upgrade nodejs12-develUpgrade npm10Upgrade nodejs8-docsUpgrade npm12Upgrade nodejs8 | Jan 16, 2020 | Dec 13, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub