Amazon Linux 2022 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2022-2022-048)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-048 advisory. A flaw was found in npm. The npm ci command proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the...

Oracle Linux 8 : nodejs:16 (ELSA-2022-4796)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-4796 advisory. - Resolves CVE-2021-43616 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not teste...

CVE-2021-43616

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have bee...