{ "cveId": "CVE-2020-8116", "url": "https://patchblox.com/security/cve/CVE-2020-8116", "summary": "CVE-2020-8116 is fixed in 7 products on 1 platform, first by ELSA-2020-4272, released October 20, 2020. It is not reported as exploited. Patch Radar priority: High.", "title": "nodejs: Node.js is a software development platform for building fast and scalable network applications in the JavaScript prog...", "description": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (10.23.1).\n\nSecurity Fix(es):\n\n* libuv: buffer overflow in realpath (CVE-2020-8252)\n\n* nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS (CVE-2020-7754)\n\n* nodejs-y18n: prototype pollution vulnerability (CVE-2020-7774)\n\n* nodejs-ini: prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-dot-prop: prototype pollution (CVE-2020-8116)\n\n* nodejs: use-after-free in the TLS implementation (CVE-2020-8265)\n\n* npm: sensitive information exposure through logs (CVE-2020-15095)\n\n* nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function (CVE-2020-15366)\n\n* nodejs-yargs-parser: prototype pollution vulnerability (CVE-2020-7608)\n\n* nodejs: HTTP request smuggling via two copies of a header field in an http request (CVE-2020-8287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "published": "2020-10-20T00:00:00Z", "severity": "Moderate", "cvss": 7.3, "epss": 0.03079, "epssPercentile": 0.87751, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "nodejs", "release": "RHEL 8", "fixedVersion": "1:10.23.1-1.module\u002Bel8.3.0\u002B9502\u002B012d8a97", "fix": "RHSA-2021:0548", "url": "https://patchblox.com/security/fix/linux/rhsa-2021-0548", "released": "2021-02-16T00:00:00Z" }, { "platform": "linux", "product": "nodejs", "release": "ol 8", "fixedVersion": "1:12.18.4-2.module\u002Bel8.2.0\u002B7806\u002B0b44ae23", "fix": "ELSA-2020-4272", "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272", "released": "2020-10-20T00:00:00Z" }, { "platform": "linux", "product": "nodejs-devel", "release": "RHEL 8", "fixedVersion": "1:10.23.1-1.module\u002Bel8.3.0\u002B9502\u002B012d8a97", "fix": "RHSA-2021:0548", "url": "https://patchblox.com/security/fix/linux/rhsa-2021-0548", "released": "2021-02-16T00:00:00Z" }, { "platform": "linux", "product": "nodejs-devel", "release": "ol 8", "fixedVersion": "1:12.18.4-2.module\u002Bel8.2.0\u002B7806\u002B0b44ae23", "fix": "ELSA-2020-4272", "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272", "released": "2020-10-20T00:00:00Z" }, { "platform": "linux", "product": "nodejs-docs", "release": "RHEL 8", "fixedVersion": "1:10.23.1-1.module\u002Bel8.3.0\u002B9502\u002B012d8a97", "fix": "RHSA-2021:0548", "url": "https://patchblox.com/security/fix/linux/rhsa-2021-0548", "released": "2021-02-16T00:00:00Z" }, { "platform": "linux", "product": "nodejs-docs", "release": "ol 8", "fixedVersion": "1:12.18.4-2.module\u002Bel8.2.0\u002B7806\u002B0b44ae23", "fix": "ELSA-2020-4272", "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272", "released": "2020-10-20T00:00:00Z" }, { "platform": "linux", "product": "nodejs-full-i18n", "release": "RHEL 8", "fixedVersion": "1:10.23.1-1.module\u002Bel8.3.0\u002B9502\u002B012d8a97", "fix": "RHSA-2021:0548", "url": "https://patchblox.com/security/fix/linux/rhsa-2021-0548", "released": "2021-02-16T00:00:00Z" }, { "platform": "linux", "product": "nodejs-full-i18n", "release": "ol 8", "fixedVersion": "1:12.18.4-2.module\u002Bel8.2.0\u002B7806\u002B0b44ae23", "fix": "ELSA-2020-4272", "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272", "released": "2020-10-20T00:00:00Z" }, { "platform": "linux", "product": "nodejs-nodemon", "release": "RHEL 8", "fixedVersion": "0:1.18.3-1.module\u002Bel8\u002B2632\u002B6c5111ed", "fix": "RHSA-2021:0548", "url": "https://patchblox.com/security/fix/linux/rhsa-2021-0548", "released": "2021-02-16T00:00:00Z" }, { "platform": "linux", "product": "nodejs-nodemon", "release": "ol 8", "fixedVersion": "0:1.18.3-1.module\u002Bel8.1.0\u002B5393\u002Baaf413e3", "fix": "ELSA-2020-4272", "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272", "released": "2020-10-20T00:00:00Z" }, { "platform": "linux", "product": "nodejs-packaging", "release": "RHEL 8", "fixedVersion": "0:17-3.module\u002Bel8\u002B2873\u002Baa7dfd9a", "fix": "RHSA-2021:0548", "url": "https://patchblox.com/security/fix/linux/rhsa-2021-0548", "released": "2021-02-16T00:00:00Z" }, { "platform": "linux", "product": "nodejs-packaging", "release": "ol 8", "fixedVersion": "0:17-3.module\u002Bel8.1.0\u002B5393\u002Baaf413e3", "fix": "ELSA-2020-4272", "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272", "released": "2020-10-20T00:00:00Z" }, { "platform": "linux", "product": "npm", "release": "RHEL 8", "fixedVersion": "1:6.14.10-1.10.23.1.1.module\u002Bel8.3.0\u002B9502\u002B012d8a97", "fix": "RHSA-2021:0548", "url": "https://patchblox.com/security/fix/linux/rhsa-2021-0548", "released": "2021-02-16T00:00:00Z" }, { "platform": "linux", "product": "npm", "release": "ol 8", "fixedVersion": "1:6.14.6-1.12.18.4.2.module\u002Bel8.2.0\u002B7806\u002B0b44ae23", "fix": "ELSA-2020-4272", "url": "https://patchblox.com/security/fix/linux/elsa-2020-4272", "released": "2020-10-20T00:00:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T00:53:09Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }