node-sass@6.0.0 vulnerabilities

Wrapper around libsass

Direct Vulnerabilities

Known vulnerabilities in the node-sass package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Improper Certificate Validation

node-sass is a Node.js bindings package for libsass.

Affected versions of this package are vulnerable to Improper Certificate Validation. Certificate validation is disabled by default when requesting binaries, even if the user is not specifying an alternative download path.

How to fix Improper Certificate Validation?

Upgrade node-sass to version 7.0.0 or higher.

>=2.0.0 <7.0.0
  • M
Denial of Service (DoS)

node-sass is a Node.js bindings package for libsass.

Affected versions of this package are vulnerable to Denial of Service (DoS). Uncontrolled recursion is possible in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp. Note: node-sass is affected by this vulnerability due to its bundled usage of the libsass package.

How to fix Denial of Service (DoS)?

There is no fixed version for node-sass.

*
  • H
Use After Free

node-sass is a Node.js bindings package for libsass.

Affected versions of this package are vulnerable to Use After Free via the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact. Note: node-sass is affected by this vulnerability due to its bundled usage of the libsass package.

How to fix Use After Free?

There is no fixed version for node-sass.

*
  • M
NULL Pointer Dereference

node-sass is a Node.js bindings package for libsass.

Affected versions of this package are vulnerable to NULL Pointer Dereference via Sass::Parser::parseCompoundSelectorin parser_selectors.cpp. Note: node-sass is affected by this vulnerability due to its bundled usage of the libsass package.

How to fix NULL Pointer Dereference?

There is no fixed version for node-sass.

*
  • M
Out-of-Bounds

node-sass is a Node.js bindings package for libsass.

Affected versions of this package are vulnerable to Out-of-Bounds via Sass::Prelexer::alternatives in prelexer.hpp. Note: node-sass is affected by this vulnerability due to its bundled usage of the libsass package.

How to fix Out-of-Bounds?

There is no fixed version for node-sass.

*
  • M
Out-of-bounds Read

node-sass is a Node.js bindings package for libsass.

Affected versions of this package are vulnerable to Out-of-bounds Read. The function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file. Note: node-sass is affected by this vulnerability due to its bundled usage of the libsass package.

How to fix Out-of-bounds Read?

There is no fixed version for node-sass.

*
  • M
Out-of-bounds Read

node-sass is a Node.js bindings package for libsass.

Affected versions of this package are vulnerable to Out-of-bounds Read via Sass::weaveParents in ast_sel_weave.cpp. Note: node-sass is affected by this vulnerability due to its bundled usage of the libsass package.

How to fix Out-of-bounds Read?

There is no fixed version for node-sass.

*
  • M
Uncontrolled Recursion

node-sass is a Node.js bindings package for libsass.

Affected versions of this package are vulnerable to Uncontrolled Recursion via Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp. Note: node-sass is affected by this vulnerability due to its bundled usage of the libsass package.

How to fix Uncontrolled Recursion?

There is no fixed version for node-sass.

*
  • H
NULL Pointer Dereference

node-sass is a Node.js bindings package for libsass.

Affected versions of this package are vulnerable to NULL Pointer Dereference in the function Sass::Functions::selector_append which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact. node-sass is affected by this vulnerability due to its bundled usage of libsass.

How to fix NULL Pointer Dereference?

There is no fixed version for node-sass.

*
  • M
Out-of-Bounds

node-sass is a Node.js bindings package for libsass.

Affected versions of this package are vulnerable to Out-of-Bounds. A heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp. node-sass is affected by this vulnerability due to its bundled usage of libsass.

How to fix Out-of-Bounds?

There is no fixed version for node-sass.

*