Description
prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it vulnerable to MITM attacks.
Remediation
References
https://nodesecurity.io/advisories/248
Related Vulnerabilities
CVE-2020-24855 Vulnerability in npm package @easy-team/easywebpack-cli
CVE-2019-12384 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2021-27644 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-server
CVE-2018-1272 Vulnerability in maven package org.springframework:spring-core
CVE-2018-1999033 Vulnerability in maven package org.jenkins-ci.plugins:anchore-container-scanner