CVE-2016-1000238

Affected versions of "node-krb5" do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials...