HIGH8.8

GHSA-73rg-x683-m3qw

Buffer overflow in canvas

Quick fix

GHSA-73rg-x683-m3qw — canvas: upgrade to the fixed version with the command below.

npm install canvas@1.6.11

Details

A buffer overflow is present in canvas versions before 1.6.11, which could lead to a Denial of Service or execution of arbitrary code when it processes a user-provided image.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/canvas

Introduced in: 0Fixed in: 1.6.11

Fixnpm install canvas@1.6.11

References

https://nvd.nist.gov/vuln/detail/CVE-2020-8215[ADVISORY]
https://github.com/Automattic/node-canvas/commit/c3e4ccb1c404da01e83fe5eb3626bf55f7f55957[WEB]
https://hackerone.com/reports/315037[WEB]
https://www.npmjs.com/package/canvas[WEB]