NodeJS/async/2.6.3
Higher-order functions and common patterns for asynchronous code
https://www.npmjs.com/package/async
MIT
1 Security Vulnerabilities
Prototype Pollution in async
Published date: 2022-04-07T00:00:17Z
CVE: CVE-2021-43138
Links:
- https://nvd.nist.gov/vuln/detail/CVE-2021-43138
- https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d
- https://github.com/caolan/async/blob/master/lib/internal/iterator.js
- https://github.com/caolan/async/blob/master/lib/mapValuesLimit.js
- https://jsfiddle.net/oz5twjd9/
- https://github.com/advisories/GHSA-fwr7-v2mv-hh25
- https://github.com/caolan/async/pull/1828
- https://github.com/caolan/async/commit/8f7f90342a6571ba1c197d747ebed30c368096d2
- https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264
- https://github.com/caolan/async/compare/v2.6.3...v2.6.4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/
- https://jsfiddle.net/oz5twjd9
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK
- https://security.netapp.com/advisory/ntap-20240621-0006
A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the mapValues() method.
Affected versions:
["2.0.1", "2.1.4", "2.4.0", "2.4.1", "2.5.0", "2.6.1", "2.0.0", "2.1.0", "2.1.1", "2.1.2", "2.1.5", "2.2.0", "2.3.0", "2.6.0", "2.6.2", "2.6.3", "3.0.1", "3.1.0", "3.1.1", "3.0.1-0", "3.0.0", "3.2.0", "3.2.1"]
Secure versions:
[0.1.0, 0.1.1, 0.1.10, 0.1.11, 0.1.12, 0.1.13, 0.1.14, 0.1.15, 0.1.16, 0.1.17, 0.1.18, 0.1.19, 0.1.2, 0.1.20, 0.1.21, 0.1.22, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0, 0.2.1, 0.2.10, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.3.0, 0.4.0, 0.4.1, 0.5.0, 0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.8.0, 0.9.0, 0.9.2, 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.3.0, 1.4.0, 1.4.1, 1.4.2, 1.5.0, 1.5.1, 1.5.2, 2.0.0-alpha.0, 2.0.0-rc.1, 2.0.0-rc.2, 2.0.0-rc.3, 2.0.0-rc.4, 2.0.0-rc.5, 2.0.0-rc.6, 2.6.4, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6]
Recommendation:
Update to version 3.2.6.
93 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 3.2.6 | MIT | 2024-08-19 - 23:24 | 11 months | |
| 3.2.5 | MIT | 2023-11-03 - 22:11 | over 1 year | |
| 3.2.4 | MIT | 2022-06-07 - 03:59 | about 3 years | |
| 3.2.3 | MIT | 2022-01-10 - 00:38 | over 3 years | |
| 3.2.2 | MIT | 2021-10-28 - 03:17 | over 3 years | |
| 3.2.1 | MIT | 1 | 2021-08-05 - 23:19 | almost 4 years |
| 3.2.0 | MIT | 1 | 2020-02-24 - 02:58 | over 5 years |
| 3.1.1 | MIT | 1 | 2020-01-24 - 23:58 | over 5 years |
| 3.1.0 | MIT | 1 | 2019-06-23 - 05:30 | about 6 years |
| 3.0.1 | MIT | 1 | 2019-05-26 - 21:43 | about 6 years |
| 3.0.1-0 | MIT | 1 | 2018-10-01 - 01:09 | almost 7 years |
| 3.0.0 | MIT | 1 | 2019-05-20 - 02:27 | about 6 years |
| 2.6.4 | MIT | 2022-04-13 - 23:07 | about 3 years | |
| 2.6.3 | MIT | 1 | 2019-07-14 - 23:30 | almost 6 years |
| 2.6.2 | MIT | 1 | 2019-02-12 - 22:36 | over 6 years |
| 2.6.1 | MIT | 1 | 2018-05-21 - 04:34 | about 7 years |
| 2.6.0 | MIT | 1 | 2017-11-07 - 02:45 | over 7 years |
| 2.5.0 | MIT | 1 | 2017-06-25 - 23:42 | about 8 years |
| 2.4.1 | MIT | 1 | 2017-05-22 - 03:57 | about 8 years |
| 2.4.0 | MIT | 1 | 2017-04-29 - 23:23 | about 8 years |
| 2.3.0 | MIT | 1 | 2017-04-02 - 22:55 | over 8 years |
| 2.2.0 | MIT | 1 | 2017-03-25 - 20:39 | over 8 years |
| 2.1.5 | MIT | 1 | 2017-02-19 - 01:31 | over 8 years |
| 2.1.4 | MIT | 1 | 2016-11-22 - 19:16 | over 8 years |
| 2.1.2 | MIT | 1 | 2016-10-16 - 22:46 | over 8 years |
| 2.1.1 | MIT | 1 | 2016-10-12 - 18:58 | over 8 years |
| 2.1.0 | MIT | 1 | 2016-10-12 - 18:22 | over 8 years |
| 2.0.1 | MIT | 1 | 2016-07-22 - 20:37 | almost 9 years |
| 2.0.0 | MIT | 1 | 2016-07-13 - 00:23 | almost 9 years |
| 2.0.0-rc.6 | MIT | 2016-06-07 - 21:13 | about 9 years | |
| 2.0.0-rc.5 | MIT | 2016-05-16 - 20:15 | about 9 years | |
| 2.0.0-rc.4 | MIT | 2016-05-05 - 23:30 | about 9 years | |
| 2.0.0-rc.3 | MIT | 2016-04-07 - 21:11 | about 9 years | |
| 2.0.0-rc.2 | MIT | 2016-03-24 - 03:39 | over 9 years | |
| 2.0.0-rc.1 | MIT | 2016-03-18 - 23:52 | over 9 years | |
| 2.0.0-alpha.0 | MIT | 2016-03-18 - 23:46 | over 9 years | |
| 1.5.2 | MIT | 2016-01-08 - 00:03 | over 9 years | |
| 1.5.1 | MIT | 2016-01-02 - 23:38 | over 9 years | |
| 1.5.0 | MIT | 2015-10-26 - 01:41 | over 9 years | |
| 1.4.2 | MIT | 2015-08-09 - 18:10 | almost 10 years | |
| 1.4.1 | MIT | 2015-08-07 - 21:08 | almost 10 years | |
| 1.4.0 | MIT | 2015-07-20 - 02:11 | almost 10 years | |
| 1.3.0 | MIT | 2015-06-29 - 16:14 | about 10 years | |
| 1.2.1 | MIT | 2015-06-08 - 01:43 | about 10 years | |
| 1.2.0 | MIT | 2015-06-02 - 20:56 | about 10 years | |
| 1.1.1 | MIT | 2015-06-08 - 01:26 | about 10 years | |
| 1.1.0 | MIT | 2015-06-01 - 07:59 | about 10 years | |
| 1.0.0 | MIT | 2015-05-20 - 23:40 | about 10 years | |
| 0.9.2 | MIT | 2015-05-19 - 08:45 | about 10 years | |
| 0.9.0 | MIT | 2014-05-16 - 10:20 | about 11 years |