critical
CVE-2020-7774
nodejs-y18n: prototype pollution vulnerability
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Red Hat7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (medium), AlmaLinux (medium), Oracle (medium), Rocky Linux (medium).
Description
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging, nodejs:12::nodejs-nodemon and 1 more | 1.18.3-1.module_el8.3.0+2023+d2377ea3 and 3 more |
| alpine 3.10 | nodejs | 10.24.1-r0 |
| alpine 3.11 | nodejs | 12.22.1-r0 |
| alpine 3.12 | nodejs | 12.22.1-r0 |
| alpine 3.13 | nodejs | 14.16.1-r0 |
| alpine 3.14 | nodejs | 14.16.1-r0 |
| alpine 3.15 | nodejs | 14.16.1-r0 |
| alpine 3.16 | nodejs | 14.16.1-r0 |
| alpine 3.17 | nodejs | 14.16.1-r0 |
| alpine 3.18 | nodejs | 14.16.1-r0 |
| alpine 3.19 | nodejs | 14.16.1-r0 |
| alpine 3.20 | nodejs | 14.16.1-r0 |
Show all 42 entries from 28 sources
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:12::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alpine 3.10 | nodejs | 10.24.1-r0 |
| alpine 3.11 | nodejs | 12.22.1-r0 |
| alpine 3.12 | nodejs | 12.22.1-r0 |
| alpine 3.13 | nodejs | 14.16.1-r0 |
| alpine 3.14 | nodejs | 14.16.1-r0 |
| alpine 3.15 | nodejs | 14.16.1-r0 |
| alpine 3.16 | nodejs | 14.16.1-r0 |
| alpine 3.17 | nodejs | 14.16.1-r0 |
| alpine 3.18 | nodejs | 14.16.1-r0 |
| alpine 3.19 | nodejs | 14.16.1-r0 |
| alpine 3.20 | nodejs | 14.16.1-r0 |
| alpine 3.21 | nodejs | 14.16.1-r0 |
| alpine 3.22 | nodejs | 14.16.1-r0 |
| alpine 3.23 | nodejs | 14.16.1-r0 |
| alpine 3.24 | nodejs | 14.16.1-r0 |
| alpine edge | nodejs | 14.16.1-r0 |
| debian 10 | node-y18n | 3.2.1-2+deb10u1 |
| debian 11 | node-y18n | 4.0.0-3 |
| debian 12 | node-y18n | 4.0.0-3 |
| debian 13 | node-y18n | 4.0.0-3 |
| debian 14 | node-y18n | 4.0.0-3 |
| debian 9 | node-y18n | no fix listed |
| echo | node-y18n | 4.0.0-3 |
| npm::GitHub Security Advisory npm | y18n | 3.2.2, 4.0.1, 5.0.5 |
| Oracle Linux 8 | nodejs | 1:14.15.4-2.module+el8.3.0+9657+a08a905a |
| Oracle Linux 8 | nodejs-devel | 1:14.15.4-2.module+el8.3.0+9657+a08a905a |
| Oracle Linux 8 | nodejs-docs | 1:14.15.4-2.module+el8.3.0+9657+a08a905a |
| Oracle Linux 8 | nodejs-full-i18n | 1:14.15.4-2.module+el8.3.0+9657+a08a905a |
| Oracle Linux 8 | nodejs-nodemon | 2.0.3-1.module+el8.3.0+7818+6cd30d85 |
| Oracle Linux 8 | nodejs-packaging | 23-3.module+el8.3.0+7818+6cd30d85 |
| Oracle Linux 8 | npm | 1:6.14.10-1.14.15.4.2.module+el8.3.0+9657+a08a905a |
| Red Hat | kiali | no fix listed |
| Red Hat | servicemesh-grafana | no fix listed |
| Red Hat | servicemesh-grafana-prometheus | no fix listed |
| rocky 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:10::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
References
- https://access.redhat.com/security/cve/CVE-2020-7774
- https://bugzilla.redhat.com/show_bug.cgi?id=1857977
- https://bugzilla.redhat.com/show_bug.cgi?id=1892430
- https://bugzilla.redhat.com/show_bug.cgi?id=1898554
- https://bugzilla.redhat.com/show_bug.cgi?id=1898680
- https://bugzilla.redhat.com/show_bug.cgi?id=1907444
- https://bugzilla.redhat.com/show_bug.cgi?id=1912854
- https://bugzilla.redhat.com/show_bug.cgi?id=1912863
All 30 references
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15366
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7754
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7774
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8265
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8277
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8287
- https://errata.almalinux.org/8/ALSA-2021-0551.html
- https://errata.rockylinux.org/RLSA-2021:0551
- https://github.com/yargs/y18n
- https://github.com/yargs/y18n/commit/90401eea9062ad498f4f792e3fff8008c4c193a3
- https://github.com/yargs/y18n/commit/a9ac604abf756dec9687be3843e2c93bfe581f25
- https://github.com/yargs/y18n/issues/96
- https://github.com/yargs/y18n/pull/108
- https://linux.oracle.com/cve/CVE-2020-7774.html
- https://linux.oracle.com/errata/ELSA-2021-0551.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-7774
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306
- https://snyk.io/vuln/SNYK-JS-Y18N-1021887
- https://www.cve.org/CVERecord?id=CVE-2020-7774
- https://www.oracle.com/security-alerts/cpuApr2021.html