nodejs / nodejs/nodejs-dependency-vuln-assessments
CVE-2025-64756: npm(glob) vulnerability
Open
Nobody has claimed this yet.
dont-believe-affects-nodejs
- Dominant language
- Python
- Stars
- 22
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
A new vulnerability for the glob library has been found last week: CVE-2025-64756.
By when can we expect a new NodeJS V22.x release containing an upgrade for the vulnerable glob library?
Regards,
Jens
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository file, test, or entry point is named. Start by reading the 11-comment discussion and the project's vulnerability-assessment conventions, then determine whether the CVE affects the NodeJS V22.x dependency set. Done means the vulnerability is assessed and the requested release or upgrade status is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100