Search for packages
Package details: pkg:alpm/archlinux/nodejs@16.6.2-1
purl pkg:alpm/archlinux/nodejs@16.6.2-1
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (3)
Vulnerability Summary Aliases
VCID-aeh3-erqz-d3c8 Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library. CVE-2021-22931
VCID-ehr3-1rdf-3yen nodejs: Use-after-free on close http2 on stream canceling CVE-2021-22940
VCID-sn12-fkzk-bqdt If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. CVE-2021-22939

Date Actor Action Vulnerability Source VulnerableCode Version
2025-07-31T11:36:20.805743+00:00 Arch Linux Importer Fixing VCID-aeh3-erqz-d3c8 https://security.archlinux.org/AVG-2286 37.0.0
2025-07-31T11:36:20.776633+00:00 Arch Linux Importer Fixing VCID-sn12-fkzk-bqdt https://security.archlinux.org/AVG-2283 37.0.0
2025-07-31T11:36:20.751291+00:00 Arch Linux Importer Fixing VCID-ehr3-1rdf-3yen https://security.archlinux.org/AVG-2283 37.0.0