118
18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE (thehackernews.com)
submitted 4 months ago* (last edited 4 months ago) by to c/selfhosted@lemmy.world
15 comments fedilink hide all child comments
 

Update your nginx instances

cross-posted from: https://lemmy.world/post/46851448

CVE - Common Vulnerabilities and Exposures system
RCE - Remote Code Execution
PoC - Proof of Concept

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 4 months ago* (last edited 4 months ago)

You can use pnpm instead of npm. pnpm has a "Delay dependency updates" feature where you can install package versions that are x old only.
See https://pnpm.io/supply-chain-security#delay-dependency-updates

Edit: I just found out, that this can also be specified in npm and yarn: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e93104

  • permalink
  • fedilink
  • source
  • parent