Homepage
About Snyk

Improper Certificate Validation Affecting node-sass package, versions >=2.0.0 <7.0.0

0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.08% (35th percentile)
Expand this section
NVD
5.3 medium
Expand this section
Red Hat
5.3 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-NODESASS-1059081
  • published 12 Jan 2021
  • disclosed 12 Jan 2021
  • credit Lorenzo Stella
Report a new vulnerability Found a mistake?

Introduced: 12 Jan 2021

CVE-2020-24025 Open this link in a new tab
CWE-295 Open this link in a new tab

How to fix?

Upgrade node-sass to version 7.0.0 or higher.

Overview

node-sass is a Node.js bindings package for libsass.

Affected versions of this package are vulnerable to Improper Certificate Validation. Certificate validation is disabled by default when requesting binaries, even if the user is not specifying an alternative download path.