CVE-2016-10652

prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

Score

CVSS 3.0 8.1 High

Status

Modified - support@hackerone.com

Published

2018-06-04

Last modified

2024-09-16

Weaknesses

CWE-310, CWE-311

Affected products

• Prebuild-lwip Node Module (Hackerone)
• Prebuild-lwip (Prebuild-lwip Project)

References

• https://nodesecurity.io/advisories/248