IBM Security Bulletin: Current Releases of IBM® SDK for Node.js™ are affected by CVE-2016-3956

HTTP bearer token leak in the npm package management tool

CVE(s): CVE-2016-3956


Affected product(s) and affected version(s):

These vulnerabilities affect IBM SDK for Node.js v1.1.0.20 and previous releases.
These vulnerabilities affect IBM SDK for Node.js v1.2.0.10 and previous releases.
These vulnerabilities affect IBM SDK for Node.js v4.4.1.0 and previous releases.

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/1Tg3dda
X-Force Database: http://ift.tt/1NSj7rJ


from IBM Product Security Incident Response Team http://ift.tt/1Tg3gWz