cee32c84af
July 2021 Security Releases: Use after free on close http2 on stream canceling (High) (CVE-2021-22930) Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930 Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
12 lines
507 B
Diff
12 lines
507 B
Diff
--- a/lib/internal/modules/cjs/loader.js
|
|
+++ b/lib/internal/modules/cjs/loader.js
|
|
@@ -1189,7 +1189,8 @@ Module._initPaths = function() {
|
|
path.resolve(process.execPath, '..') :
|
|
path.resolve(process.execPath, '..', '..');
|
|
|
|
- let paths = [path.resolve(prefixDir, 'lib', 'node')];
|
|
+ let paths = [path.resolve(prefixDir, 'lib', 'node'),
|
|
+ path.resolve(prefixDir, 'lib', 'node_modules')];
|
|
|
|
if (homeDir) {
|
|
ArrayPrototypeUnshift(paths, path.resolve(homeDir, '.node_libraries'));
|