Skip to content

update deps index.json #1547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
github-actions wants to merge 1 commit into
base: main
Choose a base branch
from
Open

update deps index.json #1547

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
118 changes: 59 additions & 59 deletions vuln/deps/index.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,61 +1,61 @@
{
"1": {
"cve": [
"CVE-2023-45853"
],
"description": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field.",
"overview": "This CVE was created for MiniZip (part of zlib/contrib/minizip), which is not used by Node.js. Node.js uses zlib for compression but does not use the MiniZip component where this vulnerability exists.",
"ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/205",
"reason": "vulnerable_code_not_present"
},
"2": {
"cve": [
"CVE-2024-7535"
],
"description": "Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
"overview": "This V8 vulnerability does not fall within Node.js's threat model. The vulnerable code path is not exposed through Node.js APIs and cannot be exploited in normal Node.js usage.",
"ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/190",
"reason": "vulnerable_code_not_in_execute_path"
},
"3": {
"cve": [
"CVE-2024-4761",
"CVE-2024-4947",
"CVE-2024-5274"
],
"description": "Out of bounds write in V8. Type Confusion in V8. Type confusion in V8 in Google Chrome.",
"overview": "These V8 vulnerabilities do not fall within Node.js's threat model. The vulnerable code paths are not exposed through Node.js APIs.",
"ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/191",
"reason": "vulnerable_code_not_in_execute_path"
},
"4": {
"cve": [
"CVE-2024-3159",
"CVE-2024-3156"
],
"description": "V8 vulnerabilities in JavaScript engine",
"overview": "These V8 vulnerabilities do not affect Node.js. The vulnerable functionality is not exposed in Node.js's implementation.",
"ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/184",
"reason": "vulnerable_code_not_in_execute_path"
},
"5": {
"cve": [
"CVE-2024-13176"
],
"description": "OpenSSL security vulnerability",
"overview": "This OpenSSL vulnerability does not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code path.",
"ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/201",
"reason": "vulnerable_code_not_in_execute_path"
},
"6": {
"cve": [
"CVE-2025-9230",
"CVE-2025-9231",
"CVE-2025-9232"
],
"description": "OpenSSL security vulnerabilities",
"overview": "These OpenSSL vulnerabilities do not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code paths.",
"ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/213",
"reason": "vulnerable_code_not_in_execute_path"
}
"1": {
"cve": [
"CVE-2023-45853"
],
"description": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field.",
"overview": "This CVE was created for MiniZip (part of zlib/contrib/minizip), which is not used by Node.js. Node.js uses zlib for compression but does not use the MiniZip component where this vulnerability exists.",
"ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/205",
"reason": "vulnerable_code_not_present"
},
"2": {
"cve": [
"CVE-2024-7535"
],
"description": "Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
"overview": "This V8 vulnerability does not fall within Node.js's threat model. The vulnerable code path is not exposed through Node.js APIs and cannot be exploited in normal Node.js usage.",
"ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/190",
"reason": "vulnerable_code_not_in_execute_path"
},
"3": {
"cve": [
"CVE-2024-4761",
"CVE-2024-4947",
"CVE-2024-5274"
],
"description": "Out of bounds write in V8. Type Confusion in V8. Type confusion in V8 in Google Chrome.",
"overview": "These V8 vulnerabilities do not fall within Node.js's threat model. The vulnerable code paths are not exposed through Node.js APIs.",
"ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/191",
"reason": "vulnerable_code_not_in_execute_path"
},
"4": {
"cve": [
"CVE-2024-3159",
"CVE-2024-3156"
],
"description": "V8 vulnerabilities in JavaScript engine",
"overview": "These V8 vulnerabilities do not affect Node.js. The vulnerable functionality is not exposed in Node.js's implementation.",
"ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/184",
"reason": "vulnerable_code_not_in_execute_path"
},
"5": {
"cve": [
"CVE-2024-13176"
],
"description": "OpenSSL security vulnerability",
"overview": "This OpenSSL vulnerability does not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code path.",
"ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/201",
"reason": "vulnerable_code_not_in_execute_path"
},
"6": {
"cve": [
"CVE-2025-9230",
"CVE-2025-9231",
"CVE-2025-9232"
],
"description": "OpenSSL security vulnerabilities",
"overview": "These OpenSSL vulnerabilities do not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code paths.",
"ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/213",
"reason": "vulnerable_code_not_in_execute_path"
}
}