AIKIDO-2024-10049
@node-red/runtime is vulnerable to Use of Weak Hash
20
Low Risk
This Affects:
@node-red/runtimeTL;DR
Affected versions of the package use an algorithm that produces a digest (output value) not meeting security expectations for a hash function, allowing an adversary to reasonably determine the original input. In the patched version, MD5 is replaced with SHA-256, enabling Node-RED to run when the FIPS crypto policy is enabled on the operating system.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@node-red/runtime is vulnerable to Use of Weak Hash in versions 0.2.0 - 3.1.5.
How to fix this
Upgrade the @node-red/runtime library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant