nodejs / nodejs/nodejs-dependency-vuln-assessments
cve-2023-45853: zlib version in node dependency showing up in scans
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 22
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
node version 18.20.5, running on linux
In our recent scans we have detected the following CVE:
https://nvd.nist.gov/vuln/detail/cve-2023-45853
The description was updated on Dec 20 to include zlib versions <= 13.1 which appears to be why our scans are suddenly flagging the issue. The version in node 18.20.5 (going up to at least node v22) appears to be 1.3.0.1. Is there a plan to patch this version in the near future?
Thank you.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the CVE-2023-45853 details and the reported zlib versions in Node 18.20.5 and later. Determine whether the dependency can be updated in the affected Node releases, then confirm the vulnerability scan no longer flags the supported versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100