CVE catalog

CVE-2022-29244

Security update for nodejs16

[CVE catalog]

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
4.00% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Opensusetumbleweednodejs1616.17.0-1.1UnknownSource applicability is not established[OPENSUSE-SU-2024:12280-1]
Suselinux enterprise module for web and scripting 15 sp4nodejs1616.17.0-150400.3.6.1UnknownSource applicability is not established[SUSE-SU-2022:3250-1]
Suselinux enterprise module for web and scripting 15 sp3nodejs1616.17.0-150300.7.9.1UnknownSource applicability is not established[SUSE-SU-2022:3251-1]
Suselinux enterprise module for web and scripting 12nodejs1616.17.0-8.9.1UnknownSource applicability is not established[SUSE-SU-2022:3196-1]
Opensuseleap 15.4nodejs1616.17.0-150400.3.6.1UnknownSource applicability is not established[SUSE-SU-2022:3250-1]
Opensuseleap 15.3nodejs1616.17.0-150300.7.9.1UnknownSource applicability is not established[SUSE-SU-2022:3251-1]
NpmRelease not reportednpm8.11.0UnknownSource applicability is not establishedProvider not reported
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
NpmRelease not reportednpm8.11.0UnknownSource applicability is not establishedProvider not reported
Opensuseleap 15.3nodejs1616.17.0-150300.7.9.1UnknownSource applicability is not established[SUSE-SU-2022:3251-1]
Opensuseleap 15.4nodejs1616.17.0-150400.3.6.1UnknownSource applicability is not established[SUSE-SU-2022:3250-1]
Opensusetumbleweednodejs1616.17.0-1.1UnknownSource applicability is not established[OPENSUSE-SU-2024:12280-1]
Suselinux enterprise module for web and scripting 12nodejs1616.17.0-8.9.1UnknownSource applicability is not established[SUSE-SU-2022:3196-1]
Suselinux enterprise module for web and scripting 15 sp3nodejs1616.17.0-150300.7.9.1UnknownSource applicability is not established[SUSE-SU-2022:3251-1]
Suselinux enterprise module for web and scripting 15 sp4nodejs1616.17.0-150400.3.6.1UnknownSource applicability is not established[SUSE-SU-2022:3250-1]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "npm",
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "7.9.0"
            },
            {
              "fixed": "8.11.0"
            }
          ]
        }
      ],
      "ecosystem": "npm",
      "fixed_version": "8.11.0",
      "applicability_unknown": true
    },
    {
      "name": "nodejs16",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.17.0-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:12280-1",
      "fixed_version": "16.17.0-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:12280-1",
      "provider_updated_at": "2026-02-04T04:35:41.705080Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs16",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.17.0-8.9.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for web and scripting 12",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:3196-1",
      "fixed_version": "16.17.0-8.9.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:3196-1",
      "provider_updated_at": "2026-02-04T04:06:40.438354Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs16",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.17.0-150300.7.9.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for web and scripting 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:3251-1",
      "fixed_version": "16.17.0-150300.7.9.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:3251-1",
      "provider_updated_at": "2026-02-04T04:04:13.518338Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs16",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.17.0-150300.7.9.1"
            }
          ]
        }
      ],
      "release": "leap 15.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:3251-1",
      "fixed_version": "16.17.0-150300.7.9.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:3251-1",
      "provider_updated_at": "2026-02-04T04:04:13.518338Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs16",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.17.0-150400.3.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for web and scripting 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:3250-1",
      "fixed_version": "16.17.0-150400.3.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:3250-1",
      "provider_updated_at": "2026-02-04T04:01:38.008685Z",
      "applicability_unknown": true
    },
    {
      "name": "nodejs16",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "16.17.0-150400.3.6.1"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:3250-1",
      "fixed_version": "16.17.0-150400.3.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:3250-1",
      "provider_updated_at": "2026-02-04T04:01:38.008685Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]