Description
prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it vulnerable to MITM attacks.
Remediation
References
https://nodesecurity.io/advisories/248
Related Vulnerabilities
CVE-2018-15685 Vulnerability in maven package org.webjars.npm:electron
CVE-2021-27185 Vulnerability in npm package samba-client
CVE-2021-27905 Vulnerability in maven package org.apache.solr:solr-core
CVE-2015-8862 Vulnerability in maven package org.webjars.npm:mustache
CVE-2023-26111 Vulnerability in npm package @nubosoftware/node-static