NodeJS/async/2.5.0
Higher-order functions and common patterns for asynchronous code
https://www.npmjs.com/package/async
MIT
1 Security Vulnerabilities
Prototype Pollution in async
Published date: 2022-04-07T00:00:17Z
CVE: CVE-2021-43138
Links:
- https://nvd.nist.gov/vuln/detail/CVE-2021-43138
- https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d
- https://github.com/caolan/async/blob/master/lib/internal/iterator.js
- https://github.com/caolan/async/blob/master/lib/mapValuesLimit.js
- https://jsfiddle.net/oz5twjd9/
- https://github.com/advisories/GHSA-fwr7-v2mv-hh25
- https://github.com/caolan/async/pull/1828
- https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2
- https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264
- https://github.com/caolan/async/compare/v2.6.3...v2.6.4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/
- https://jsfiddle.net/oz5twjd9
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK
- https://security.netapp.com/advisory/ntap-20240621-0006
A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the mapValues() method.
Affected versions:
["2.0.1", "2.1.4", "2.4.0", "2.4.1", "2.5.0", "2.6.1", "2.0.0", "2.1.0", "2.1.1", "2.1.2", "2.1.5", "2.2.0", "2.3.0", "2.6.0", "2.6.2", "2.6.3", "3.0.1", "3.1.0", "3.1.1", "3.0.1-0", "3.0.0", "3.2.0", "3.2.1"]
Secure versions:
[0.1.0, 0.1.1, 0.1.10, 0.1.11, 0.1.12, 0.1.13, 0.1.14, 0.1.15, 0.1.16, 0.1.17, 0.1.18, 0.1.19, 0.1.2, 0.1.20, 0.1.21, 0.1.22, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0, 0.2.1, 0.2.10, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.3.0, 0.4.0, 0.4.1, 0.5.0, 0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.8.0, 0.9.0, 0.9.2, 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.3.0, 1.4.0, 1.4.1, 1.4.2, 1.5.0, 1.5.1, 1.5.2, 2.0.0-alpha.0, 2.0.0-rc.1, 2.0.0-rc.2, 2.0.0-rc.3, 2.0.0-rc.4, 2.0.0-rc.5, 2.0.0-rc.6, 2.6.4, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6]
Recommendation:
Update to version 3.2.6.
93 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 0.8.0 | MIT | 2014-04-29 - 15:26 | about 11 years | |
| 0.7.0 | MIT | 2014-04-07 - 09:07 | about 11 years | |
| 0.6.2 | MIT | 2014-03-31 - 09:56 | over 11 years | |
| 0.6.1 | MIT | 2014-03-30 - 20:35 | over 11 years | |
| 0.6.0 | MIT | 2014-03-30 - 12:04 | over 11 years | |
| 0.5.0 | MIT | 2014-03-30 - 11:46 | over 11 years | |
| 0.4.1 | MIT | 2014-03-30 - 11:42 | over 11 years | |
| 0.4.0 | MIT | 2014-03-28 - 17:25 | over 11 years | |
| 0.3.0 | MIT | 2014-03-28 - 17:16 | over 11 years | |
| 0.2.10 | MIT | 2014-01-23 - 16:23 | over 11 years | |
| 0.2.9 | MIT | 2013-05-28 - 07:50 | about 12 years | |
| 0.2.8 | MIT | 2013-05-01 - 10:04 | about 12 years | |
| 0.2.7 | MIT | 2013-04-09 - 20:50 | about 12 years | |
| 0.2.6 | MIT | 2013-03-03 - 11:29 | over 12 years | |
| 0.2.5 | MIT | 2013-02-10 - 22:42 | over 12 years | |
| 0.2.4 | MIT | 2013-02-07 - 17:26 | over 12 years | |
| 0.2.3 | MIT | 2013-02-06 - 12:48 | over 12 years | |
| 0.2.2 | MIT | 2013-02-05 - 15:55 | over 12 years | |
| 0.2.1 | MIT | 2013-02-04 - 11:52 | over 12 years | |
| 0.2.0 | MIT | 2013-02-04 - 11:38 | over 12 years | |
| 0.1.22 | MIT | 2012-05-30 - 18:26 | about 13 years | |
| 0.1.21 | MIT | 2012-05-24 - 07:16 | about 13 years | |
| 0.1.20 | MIT | 2012-05-24 - 06:53 | about 13 years | |
| 0.1.19 | MIT | 2012-05-24 - 06:51 | about 13 years | |
| 0.1.18 | MIT | 2012-02-27 - 16:51 | over 13 years | |
| 0.1.17 | MIT | 2012-02-27 - 02:40 | over 13 years | |
| 0.1.16 | MIT | 2012-02-13 - 04:56 | over 13 years | |
| 0.1.15 | MIT | 2011-11-01 - 23:05 | over 13 years | |
| 0.1.14 | MIT | 2011-10-29 - 22:40 | over 13 years | |
| 0.1.13 | MIT | 2011-10-29 - 22:33 | over 13 years | |
| 0.1.12 | MIT | 2011-10-14 - 17:19 | over 13 years | |
| 0.1.11 | MIT | 2011-10-14 - 17:07 | over 13 years | |
| 0.1.10 | MIT | 2011-09-19 - 04:40 | almost 14 years | |
| 0.1.9 | MIT | 2011-04-27 - 20:48 | about 14 years | |
| 0.1.8 | MIT | 2011-01-18 - 09:56 | over 14 years | |
| 0.1.7 | MIT | 2010-12-19 - 16:41 | over 14 years | |
| 0.1.6 | MIT | 2010-12-19 - 16:41 | over 14 years | |
| 0.1.5 | MIT | 2010-12-19 - 16:41 | over 14 years | |
| 0.1.4 | MIT | 2010-12-19 - 16:41 | over 14 years | |
| 0.1.3 | MIT | 2010-12-19 - 16:41 | over 14 years | |
| 0.1.2 | MIT | 2010-12-19 - 16:41 | over 14 years | |
| 0.1.1 | MIT | 2010-12-19 - 16:41 | over 14 years | |
| 0.1.0 | MIT | 2010-12-19 - 16:41 | over 14 years |