CVE catalog

CVE-2019-13173

node-fstream affected and fixed versions

[CVE catalog]

fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.

Severity
High · CVSS 7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
2.42% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixienode-fstream1.0.12-1FixedDistribution-reported fixed boundary[CVE-2019-13173]
Debiantrixienode-fstream1.0.12-7Fixed[CVE-2019-13173]
Debianbookwormnode-fstream1.0.12-1FixedDistribution-reported fixed boundary[CVE-2019-13173]
Debianbookwormnode-fstream1.0.12-7Fixed[CVE-2019-13173]

Showing 4 fix observations. All 25 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
NpmRelease not reportedfstream1.0.12UnknownSource applicability is not established[GHSA-XF7W-R453-M56C]
Debianbookwormnode-fstream1.0.12-1FixedDistribution-reported fixed boundary[CVE-2019-13173]
Debianbookwormnode-fstream1.0.12-7Fixed[CVE-2019-13173]
Debiantrixienode-fstream1.0.12-1FixedDistribution-reported fixed boundary[CVE-2019-13173]
Debiantrixienode-fstream1.0.12-7Fixed[CVE-2019-13173]
Opensuseleap 15.0nodejs88.15.1-lp151.2.3.1UnknownSource applicability is not established[OPENSUSE-SU-2019:1907-1]
Opensuseleap 15.1nodejs1010.16.0-lp151.2.3.1UnknownSource applicability is not established[OPENSUSE-SU-2019:1846-1]
Opensuseleap 15.1nodejs88.15.1-lp151.2.3.1UnknownSource applicability is not established[OPENSUSE-SU-2019:1907-1]
Suseenterprise storage 4nodejs44.9.1-15.23.1UnknownSource applicability is not established[SUSE-SU-2019:2078-1]
Suseenterprise storage 4nodejs66.17.0-11.27.1UnknownSource applicability is not established[SUSE-SU-2019:2181-1]
Suselinux enterprise module for web and scripting 12nodejs1010.16.0-1.9.1UnknownSource applicability is not established[SUSE-SU-2019:2099-1]
Suselinux enterprise module for web and scripting 12nodejs1212.13.0-1.3.1UnknownSource applicability is not established[SUSE-SU-2020:0059-1]
Suselinux enterprise module for web and scripting 12nodejs44.9.1-15.23.1UnknownSource applicability is not established[SUSE-SU-2019:2078-1]
Suselinux enterprise module for web and scripting 12nodejs66.17.0-11.27.1UnknownSource applicability is not established[SUSE-SU-2019:2181-1]
Suselinux enterprise module for web and scripting 15nodejs1010.16.0-1.9.1UnknownSource applicability is not established[SUSE-SU-2019:2081-1]
Suselinux enterprise module for web and scripting 15nodejs88.15.1-3.17.1UnknownSource applicability is not established[SUSE-SU-2019:2055-1]
Suselinux enterprise module for web and scripting 15 sp1nodejs1010.16.0-1.9.1UnknownSource applicability is not established[SUSE-SU-2019:2081-1]
Suselinux enterprise module for web and scripting 15 sp1nodejs88.15.1-3.17.1UnknownSource applicability is not established[SUSE-SU-2019:2055-1]
Suseopenstack cloud 7nodejs66.17.0-11.27.1UnknownSource applicability is not established[SUSE-SU-2019:2181-1]
Suseopenstack cloud crowbar 8nodejs66.17.0-11.27.1UnknownSource applicability is not established[SUSE-SU-2019:2181-1]
Suseopenstack cloud crowbar 9nodejs66.17.0-11.27.1UnknownSource applicability is not established[SUSE-SU-2019:2181-1]
Ubuntu18.04node-fstream1.0.10-1UnknownSource applicability is not established[USN-4123-1][UBUNTU-CVE-2019-13173]
Ubuntu18.04node-fstream1.0.10-1ubuntu0.18.04.1UnknownSource applicability is not established[USN-4123-1][UBUNTU-CVE-2019-13173]
Ubuntupronode-fstream0.1.24-1UnknownSource applicability is not established[USN-4863-1][UBUNTU-CVE-2019-13173]
Ubuntupronode-fstream0.1.24-1ubuntu0.16.04.1~esm1UnknownSource applicability is not established[USN-4863-1][UBUNTU-CVE-2019-13173]
Original provider fields
{
  "package_releases": [
    {
      "name": "node-fstream",
      "status": "fixed",
      "release": "trixie",
      "version": "1.0.12-7"
    },
    {
      "name": "node-fstream",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.0.12-7"
    }
  ],
  "fixed_versions": [
    {
      "bug": 931408,
      "name": "node-fstream",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.0.12-1"
    },
    {
      "bug": 931408,
      "name": "node-fstream",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.0.12-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "fstream",
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.12"
            }
          ]
        }
      ],
      "ecosystem": "npm",
      "provider_url": "https://osv.dev/vulnerability/GHSA-xf7w-r453-m56c",
      "fixed_version": "1.0.12",
      "provider_source": "pypi",
      "provider_record_id": "GHSA-XF7W-R453-M56C",
      "provider_updated_at": "2023-11-08T04:01:07.720925Z",
      "applicability_unknown": true
    },
    {
      "name": "node-fstream",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.24-1ubuntu0.16.04.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "0.1.24-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-4863-1",
      "fixed_version": "0.1.24-1ubuntu0.16.04.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "USN-4863-1",
      "provider_updated_at": "2026-06-29T13:48:00.205051812Z",
      "applicability_unknown": true
    },
    {
      "name": "node-fstream",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.10-1ubuntu0.18.04.1"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.0.10-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-4123-1",
      "fixed_version": "1.0.10-1ubuntu0.18.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-4123-1",
      "provider_updated_at": "2026-02-10T04:41:38Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs10",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.16.0-lp151.2.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:1846-1",
      "fixed_version": "10.16.0-lp151.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2019:1846-1",
      "provider_updated_at": "2026-02-04T04:36:04.314724Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs10",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.16.0-1.9.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for web and scripting 15",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2081-1",
      "fixed_version": "10.16.0-1.9.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2081-1",
      "provider_updated_at": "2026-02-04T04:25:13.634629Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs10",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.16.0-1.9.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for web and scripting 15 sp1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2081-1",
      "fixed_version": "10.16.0-1.9.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2081-1",
      "provider_updated_at": "2026-02-04T04:25:13.634629Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs4",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.9.1-15.23.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for web and scripting 12",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2078-1",
      "fixed_version": "4.9.1-15.23.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2078-1",
      "provider_updated_at": "2026-02-04T03:48:38.692275Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs4",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.9.1-15.23.1"
            }
          ]
        }
      ],
      "release": "enterprise storage 4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2078-1",
      "fixed_version": "4.9.1-15.23.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2078-1",
      "provider_updated_at": "2026-02-04T03:48:38.692275Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs10",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.16.0-1.9.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for web and scripting 12",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2099-1",
      "fixed_version": "10.16.0-1.9.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2099-1",
      "provider_updated_at": "2026-02-04T03:39:59.238207Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs8",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.15.1-lp151.2.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:1907-1",
      "fixed_version": "8.15.1-lp151.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2019:1907-1",
      "provider_updated_at": "2026-02-04T03:30:17.538091Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs8",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.15.1-lp151.2.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:1907-1",
      "fixed_version": "8.15.1-lp151.2.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2019:1907-1",
      "provider_updated_at": "2026-02-04T03:30:17.538091Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs12",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.13.0-1.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for web and scripting 12",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2020:0059-1",
      "fixed_version": "12.13.0-1.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2020:0059-1",
      "provider_updated_at": "2026-02-04T03:18:59.602282Z",
      "applicability_unknown": true
    },
    {
      "name": "node-fstream",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.24-1ubuntu0.16.04.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "0.1.24-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-13173",
      "fixed_version": "0.1.24-1ubuntu0.16.04.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-13173",
      "provider_updated_at": "2026-02-04T03:11:46.240147Z",
      "applicability_unknown": true
    },
    {
      "name": "node-fstream",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.10-1ubuntu0.18.04.1"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.0.10-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-13173",
      "fixed_version": "1.0.10-1ubuntu0.18.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-13173",
      "provider_updated_at": "2026-02-04T03:11:46.240147Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs6",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.17.0-11.27.1"
            }
          ]
        }
      ],
      "release": "openstack cloud 7",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2181-1",
      "fixed_version": "6.17.0-11.27.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2181-1",
      "provider_updated_at": "2026-02-04T03:08:54.198266Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs6",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.17.0-11.27.1"
            }
          ]
        }
      ],
      "release": "openstack cloud crowbar 8",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2181-1",
      "fixed_version": "6.17.0-11.27.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2181-1",
      "provider_updated_at": "2026-02-04T03:08:54.198266Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs6",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.17.0-11.27.1"
            }
          ]
        }
      ],
      "release": "openstack cloud crowbar 9",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2181-1",
      "fixed_version": "6.17.0-11.27.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2181-1",
      "provider_updated_at": "2026-02-04T03:08:54.198266Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs6",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.17.0-11.27.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for web and scripting 12",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2181-1",
      "fixed_version": "6.17.0-11.27.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2181-1",
      "provider_updated_at": "2026-02-04T03:08:54.198266Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs6",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.17.0-11.27.1"
            }
          ]
        }
      ],
      "release": "enterprise storage 4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2181-1",
      "fixed_version": "6.17.0-11.27.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2181-1",
      "provider_updated_at": "2026-02-04T03:08:54.198266Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs8",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.15.1-3.17.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for web and scripting 15",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2055-1",
      "fixed_version": "8.15.1-3.17.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2055-1",
      "provider_updated_at": "2026-02-04T03:03:10.195671Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs8",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.15.1-3.17.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for web and scripting 15 sp1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2055-1",
      "fixed_version": "8.15.1-3.17.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2019:2055-1",
      "provider_updated_at": "2026-02-04T03:03:10.195671Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #931408]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [node-fstream]Unknown
    Details (2)

    • 1.0.12-7 · all · bookworm

      Fixed · Fixed: 1.0.12-1

      dsa · node-fstream · debian · bookworm; dsa · node-fstream · debian · 12

    • 1.0.12-7 · all · bookworm

      Fixed · Fixed: 1.0.12-1

      dsa · node-fstream · debian · bookworm; dsa · node-fstream · debian · 12

[Debian 13 (Trixie)]

  • [node-fstream]Unknown
    Details (2)

    • 1.0.12-7 · all · trixie

      Fixed · Fixed: 1.0.12-1

      dsa · node-fstream · debian · 13

    • 1.0.12-7 · all · trixie

      Fixed · Fixed: 1.0.12-1

      dsa · node-fstream · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]