Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

tiny-json-http

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1npmAmendedPublished

    tiny-json-http missing SSL certificate validation

    CVE-2018-1000096 · GHSA-7h42-5vj2-cq39

    Affected
    • npm tiny-json-http >= 1.0.1, < 7.0.0
    Fixed in
    7.0.0· Vendor fix available
    Issue
    brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL certificate validation vulnerability in The libraries core functionality is affected. that can result in Exposes the user to man-in-the-middle attacks.

    Recommended action: Upgrade to 7.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →