# CVE-2018-3750: nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog...

CVE-2018-3750 is fixed in 7 products on 1 platform, first by RHSA-2021:0549, released February 16, 2021. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2018-3750
- Priority: Routine
- CVSS: 4.2 (Moderate)
- EPSS: 0.0215
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 16, 2021

## Description

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   The following packages have been upgraded to a later upstream version: nodejs (12.20.1), nodejs-nodemon (2.0.3).  Security Fix(es):  * nodejs-mixin-deep: prototype pollution in function mixin-deep (CVE-2019-10746)  * nodejs-set-value: prototype pollution in function set-value (CVE-2019-10747)  * nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)  * nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)  * nodejs: use-after-free in the TLS implementation (CVE-2020-8265)  * nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | nodejs RHEL 8 | 1:12.20.1-1.module+el8.3.0+9503+19cb079c | [RHSA-2021:0549](https://patchblox.com/security/data/fix/linux/rhsa-2021-0549.md) | Feb 16, 2021 |
| Linux | nodejs-devel RHEL 8 | 1:12.20.1-1.module+el8.3.0+9503+19cb079c | [RHSA-2021:0549](https://patchblox.com/security/data/fix/linux/rhsa-2021-0549.md) | Feb 16, 2021 |
| Linux | nodejs-docs RHEL 8 | 1:12.20.1-1.module+el8.3.0+9503+19cb079c | [RHSA-2021:0549](https://patchblox.com/security/data/fix/linux/rhsa-2021-0549.md) | Feb 16, 2021 |
| Linux | nodejs-full-i18n RHEL 8 | 1:12.20.1-1.module+el8.3.0+9503+19cb079c | [RHSA-2021:0549](https://patchblox.com/security/data/fix/linux/rhsa-2021-0549.md) | Feb 16, 2021 |
| Linux | nodejs-nodemon RHEL 8 | 0:2.0.3-1.module+el8.3.0+9715+1718613f | [RHSA-2021:0549](https://patchblox.com/security/data/fix/linux/rhsa-2021-0549.md) | Feb 16, 2021 |
| Linux | nodejs-packaging RHEL 8 | 0:17-3.module+el8.1.0+3369+37ae6a45 | [RHSA-2021:0549](https://patchblox.com/security/data/fix/linux/rhsa-2021-0549.md) | Feb 16, 2021 |
| Linux | npm RHEL 8 | 1:6.14.10-1.12.20.1.1.module+el8.3.0+9503+19cb079c | [RHSA-2021:0549](https://patchblox.com/security/data/fix/linux/rhsa-2021-0549.md) | Feb 16, 2021 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo