Skip to content
This repository was archived by the owner on Sep 21, 2025. It is now read-only.

Commit b633254

Browse files
committed
Automatic github actions updates. Changes found @lightswitch05
1 parent e9a67d7 commit b633254

3 files changed

Lines changed: 8 additions & 8 deletions

File tree

docs/rules-v1.json

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"lastUpdatedDate": "2025-04-02T13:34:51.085Z",
2+
"lastUpdatedDate": "2025-04-03T02:37:27.995Z",
33
"name": "Node Version Audit",
44
"website": "https://github.com/lightswitch05/node-version-audit",
55
"license": "https://github.com/lightswitch05/node-version-audit/blob/master/LICENSE",
@@ -5477,9 +5477,9 @@
54775477
},
54785478
"CVE-2024-21896": {
54795479
"id": "CVE-2024-21896",
5480-
"baseScore": null,
5480+
"baseScore": 9.8,
54815481
"publishedDate": "2024-02-20T02:15:00.000Z",
5482-
"lastModifiedDate": "2024-11-21T08:55:00.000Z",
5482+
"lastModifiedDate": "2025-04-02T20:09:00.000Z",
54835483
"description": "The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js."
54845484
},
54855485
"CVE-2024-22017": {
@@ -5498,9 +5498,9 @@
54985498
},
54995499
"CVE-2024-22019": {
55005500
"id": "CVE-2024-22019",
5501-
"baseScore": null,
5501+
"baseScore": 7.5,
55025502
"publishedDate": "2024-02-20T02:15:00.000Z",
5503-
"lastModifiedDate": "2024-11-21T08:55:00.000Z",
5503+
"lastModifiedDate": "2025-04-02T20:10:00.000Z",
55045504
"description": "A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits."
55055505
},
55065506
"CVE-2024-22020": {

package-lock.json

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "node-version-audit",
3-
"version": "1.20250402.0",
3+
"version": "1.20250403.0",
44
"description": "Audit your Node version for known CVEs and patches ",
55
"main": "index.js",
66
"scripts": {

0 commit comments

Comments
 (0)