CVE catalog

CVE-2020-7774

node-y18n: CVE-2020-7774

[CVE catalog]

Severity
High · CVSS 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
69.38% · Oct 25, 2026

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-y18nsid5.0.8+~5.0.0-5fixed
Debiannode-y18nforky5.0.8+~5.0.0-5fixed
Debiannode-y18ntrixie5.0.8+~5.0.0-3fixed
Debiannode-y18nbookworm5.0.8+~5.0.0-3fixed
Npmy18nNot reported3.2.2fixed
Npmy18nNot reported4.0.1fixed
Npmy18nNot reported5.0.5fixed
Alpinenodejs3.1010.24.1-r0fixed
Alpinenodejs3.1112.22.1-r0fixed
Alpinenodejs3.1212.22.1-r0fixed
Alpinenodejs3.1314.16.1-r0fixed
Alpinenodejs3.1414.16.1-r0fixed
Alpinenodejs3.1514.16.1-r0fixed
Alpinenodejs3.1614.16.1-r0fixed
Alpinenodejs3.1714.16.1-r0fixed
Alpinenodejs3.1814.16.1-r0fixed
Alpinenodejs3.1914.16.1-r0fixed
Alpinenodejs3.2014.16.1-r0fixed
Alpinenodejs3.2114.16.1-r0fixed
Alpinenodejs3.2214.16.1-r0fixed
Alpinenodejs3.2314.16.1-r0fixed
Alpinenodejs3.2414.16.1-r0fixed
Susenodejs12linux enterprise module for web and scripting 15 sp212.22.2-4.16.1fixed
Susenodejs12linux enterprise module for web and scripting 15 sp312.22.2-4.16.1fixed
Opensusenodejs10leap 15.310.24.1-1.36.1fixed
Susenodejs10linux enterprise module for web and scripting 1210.24.1-1.39.1fixed
Susenodejs10linux enterprise module for web and scripting 15 sp210.24.1-1.36.1fixed
Susenodejs10linux enterprise high performance computing 15-espos10.24.1-1.36.1fixed
Susenodejs10linux enterprise high performance computing 15-ltss10.24.1-1.36.1fixed
Susenodejs10linux enterprise high performance computing 15 sp1-espos10.24.1-1.36.1fixed
Susenodejs10linux enterprise high performance computing 15 sp1-ltss10.24.1-1.36.1fixed
Susenodejs10linux enterprise server 15-ltss10.24.1-1.36.1fixed
Susenodejs10linux enterprise server 15 sp1-bcl10.24.1-1.36.1fixed
Susenodejs10linux enterprise server 15 sp1-ltss10.24.1-1.36.1fixed
Susenodejs10linux enterprise server for sap applications 1510.24.1-1.36.1fixed
Susenodejs10linux enterprise server for sap applications 15 sp110.24.1-1.36.1fixed
Susenodejs10manager proxy 4.010.24.1-1.36.1fixed
Susenodejs10manager retail branch server 4.010.24.1-1.36.1fixed
Susenodejs10manager server 4.010.24.1-1.36.1fixed
Susenodejs10enterprise storage 610.24.1-1.36.1fixed
Opensusenodejs8leap 15.28.17.0-lp152.3.14.1fixed
Opensusenodejs14leap 15.314.17.2-5.12.1fixed
Susenodejs14linux enterprise module for web and scripting 15 sp214.17.2-5.12.1fixed
Susenodejs14linux enterprise module for web and scripting 15 sp314.17.2-5.12.1fixed
Opensusenodejs12leap 15.312.22.2-4.16.1fixed
Opensusenodejs8leap 15.38.17.0-10.12.2fixed
Opensusenodejs12leap 15.212.22.2-lp152.3.15.1fixed
Opensusenodejs10leap 15.210.24.1-lp152.2.15.1fixed
Opensusenodejs14leap 15.214.17.2-lp152.11.1fixed
Susenodejs-commonlinux enterprise module for web and scripting 15 sp22.0-3.2.1fixed
Susenodejs-commonlinux enterprise high performance computing 15-espos2.0-3.2.1fixed
Susenodejs8linux enterprise high performance computing 15-espos8.17.0-3.47.2fixed
Susenodejs-commonlinux enterprise high performance computing 15-ltss2.0-3.2.1fixed
Susenodejs8linux enterprise high performance computing 15-ltss8.17.0-3.47.2fixed
Susenodejs-commonlinux enterprise high performance computing 15 sp1-espos2.0-3.2.1fixed
Susenodejs8linux enterprise high performance computing 15 sp1-espos8.17.0-3.47.2fixed
Susenodejs-commonlinux enterprise high performance computing 15 sp1-ltss2.0-3.2.1fixed
Susenodejs8linux enterprise high performance computing 15 sp1-ltss8.17.0-3.47.2fixed
Susenodejs-commonlinux enterprise server 15-ltss2.0-3.2.1fixed
Susenodejs8linux enterprise server 15-ltss8.17.0-3.47.2fixed
Susenodejs-commonlinux enterprise server 15 sp1-bcl2.0-3.2.1fixed
Susenodejs8linux enterprise server 15 sp1-bcl8.17.0-3.47.2fixed
Susenodejs-commonlinux enterprise server 15 sp1-ltss2.0-3.2.1fixed
Susenodejs8linux enterprise server 15 sp1-ltss8.17.0-3.47.2fixed
Susenodejs-commonlinux enterprise server for sap applications 152.0-3.2.1fixed
Susenodejs8linux enterprise server for sap applications 158.17.0-3.47.2fixed
Susenodejs-commonlinux enterprise server for sap applications 15 sp12.0-3.2.1fixed
Susenodejs8linux enterprise server for sap applications 15 sp18.17.0-3.47.2fixed
Susenodejs-commonmanager proxy 4.02.0-3.2.1fixed
Susenodejs8manager proxy 4.08.17.0-3.47.2fixed
Susenodejs-commonmanager retail branch server 4.02.0-3.2.1fixed
Susenodejs8manager retail branch server 4.08.17.0-3.47.2fixed
Susenodejs-commonmanager server 4.02.0-3.2.1fixed
Susenodejs8manager server 4.08.17.0-3.47.2fixed
Susenodejs-commonenterprise storage 62.0-3.2.1fixed
Susenodejs8enterprise storage 68.17.0-3.47.2fixed
Susenodejs12linux enterprise module for web and scripting 1212.22.2-1.32.1fixed
Susenodejs8linux enterprise module for web and scripting 15 sp28.17.0-10.12.2fixed
Susenodejs14linux enterprise module for web and scripting 1214.17.2-6.12.1fixed
Ubuntunode-y18n18.043.2.1-2vulnerable
Ubuntunode-y18n20.044.0.0-2vulnerable
Ubuntunode-y18n22.044.0.0-4vulnerable
Ubuntunode-y18n22.045.0.8-2vulnerable
Ubuntunode-y18n22.045.0.8+~5.0.0-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-y18nsourcesid4.0.0-3not yet assignedNot reported[976390]
Debiannode-y18nsourceforky4.0.0-3not yet assignedNot reported[976390]
Debiannode-y18nsourcetrixie4.0.0-3not yet assignedNot reported[976390]
Debiannode-y18nsourcebookworm4.0.0-3not yet assignedNot reported[976390]
Npmy18nnpmNot reported3.2.2Not reportedNot reportedNot reported
Npmy18nnpmNot reported4.0.1Not reportedNot reportedNot reported
Npmy18nnpmNot reported5.0.5Not reportedNot reportedNot reported
Alpinenodejsapk3.1010.24.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.1112.22.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.1212.22.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.1314.16.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.1414.16.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.1514.16.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.1614.16.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.1714.16.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.1814.16.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.1914.16.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.2014.16.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.2114.16.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.2214.16.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.2314.16.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Alpinenodejsapk3.2414.16.1-r0Not reportedALPINE-CVE-2020-7774Not reported
Susenodejs12rpmlinux enterprise module for web and scripting 15 sp212.22.2-4.16.1Not reportedSUSE-SU-2021:2327-1Not reported
Susenodejs12rpmlinux enterprise module for web and scripting 15 sp312.22.2-4.16.1Not reportedSUSE-SU-2021:2327-1Not reported
Opensusenodejs10rpmleap 15.310.24.1-1.36.1Not reportedOPENSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmlinux enterprise module for web and scripting 1210.24.1-1.39.1Not reportedSUSE-SU-2021:2323-1Not reported
Susenodejs10rpmlinux enterprise module for web and scripting 15 sp210.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15-espos10.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15-ltss10.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15 sp1-espos10.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15 sp1-ltss10.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmlinux enterprise server 15-ltss10.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmlinux enterprise server 15 sp1-bcl10.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmlinux enterprise server 15 sp1-ltss10.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmlinux enterprise server for sap applications 1510.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmlinux enterprise server for sap applications 15 sp110.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmmanager proxy 4.010.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmmanager retail branch server 4.010.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmmanager server 4.010.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Susenodejs10rpmenterprise storage 610.24.1-1.36.1Not reportedSUSE-SU-2021:2353-1Not reported
Opensusenodejs8rpmleap 15.28.17.0-lp152.3.14.1Not reportedOPENSUSE-SU-2021:1113-1Not reported
Opensusenodejs14rpmleap 15.314.17.2-5.12.1Not reportedOPENSUSE-SU-2021:2354-1Not reported
Susenodejs14rpmlinux enterprise module for web and scripting 15 sp214.17.2-5.12.1Not reportedSUSE-SU-2021:2354-1Not reported
Susenodejs14rpmlinux enterprise module for web and scripting 15 sp314.17.2-5.12.1Not reportedSUSE-SU-2021:2354-1Not reported
Opensusenodejs12rpmleap 15.312.22.2-4.16.1Not reportedOPENSUSE-SU-2021:2327-1Not reported
Opensusenodejs8rpmleap 15.38.17.0-10.12.2Not reportedOPENSUSE-SU-2021:2618-1Not reported
Opensusenodejs12rpmleap 15.212.22.2-lp152.3.15.1Not reportedOPENSUSE-SU-2021:1059-1Not reported
Opensusenodejs10rpmleap 15.210.24.1-lp152.2.15.1Not reportedOPENSUSE-SU-2021:1061-1Not reported
Opensusenodejs14rpmleap 15.214.17.2-lp152.11.1Not reportedOPENSUSE-SU-2021:1060-1Not reported
Susenodejs-commonrpmlinux enterprise module for web and scripting 15 sp22.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmlinux enterprise high performance computing 15-espos2.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmlinux enterprise high performance computing 15-espos8.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmlinux enterprise high performance computing 15-ltss2.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmlinux enterprise high performance computing 15-ltss8.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmlinux enterprise high performance computing 15 sp1-espos2.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmlinux enterprise high performance computing 15 sp1-espos8.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmlinux enterprise high performance computing 15 sp1-ltss2.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmlinux enterprise high performance computing 15 sp1-ltss8.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmlinux enterprise server 15-ltss2.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmlinux enterprise server 15-ltss8.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmlinux enterprise server 15 sp1-bcl2.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmlinux enterprise server 15 sp1-bcl8.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmlinux enterprise server 15 sp1-ltss2.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmlinux enterprise server 15 sp1-ltss8.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmlinux enterprise server for sap applications 152.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmlinux enterprise server for sap applications 158.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmlinux enterprise server for sap applications 15 sp12.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmlinux enterprise server for sap applications 15 sp18.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmmanager proxy 4.02.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmmanager proxy 4.08.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmmanager retail branch server 4.02.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmmanager retail branch server 4.08.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmmanager server 4.02.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmmanager server 4.08.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs-commonrpmenterprise storage 62.0-3.2.1Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs8rpmenterprise storage 68.17.0-3.47.2Not reportedSUSE-SU-2021:2620-1Not reported
Susenodejs12rpmlinux enterprise module for web and scripting 1212.22.2-1.32.1Not reportedSUSE-SU-2021:2326-1Not reported
Susenodejs8rpmlinux enterprise module for web and scripting 15 sp28.17.0-10.12.2Not reportedSUSE-SU-2021:2618-1Not reported
Susenodejs14rpmlinux enterprise module for web and scripting 1214.17.2-6.12.1Not reportedSUSE-SU-2021:2319-1Not reported

[Debian bug #976390]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [node-y18n]Unknown
    Details (2)
    • 5.0.8+~5.0.0-3 · all · bookworm

      Fixed · Fixed: 4.0.0-3

      dsa · node-y18n · debian · bookworm; dsa · node-y18n · debian · 12

    • 5.0.8+~5.0.0-3 · all · bookworm

      Fixed · Fixed: 4.0.0-3

      dsa · node-y18n · debian · bookworm; dsa · node-y18n · debian · 12

[Debian 13 (Trixie)]

  • [node-y18n]Unknown
    Details (2)
    • 5.0.8+~5.0.0-3 · all · trixie

      Fixed · Fixed: 4.0.0-3

      dsa · node-y18n · debian · 13

    • 5.0.8+~5.0.0-3 · all · trixie

      Fixed · Fixed: 4.0.0-3

      dsa · node-y18n · debian · 13

Observed:

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]