GitHub Advisoryadvisory · npm

GHSA-57cf-349j-352g Out-of-bounds Read in npmconf

MEDIUM Published 2019-06-12 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
npmconf
Severity
Moderate
Weaknesses
CWE-125
Reviewed
2019-06-12

Affected packages

• npm npmconf: < 2.1.3 → fixed in 2.1.3

Description

Versions of `npmconf` before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x. Recommendation Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used.

Related

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References