A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-docs | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Aug 22, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejsUpgrade v8-develUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-docs | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejsUpgrade npm | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Oct 7, 2022 | Jul 14, 2022 |
| Freebsd | — | Upgrade node16Upgrade nodeUpgrade node14 | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-17-toolsUpgrade nodejs-packagingUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-11-javascriptUpgrade nodejs-full-i18nUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-17-fastrUpgrade nodejs-libsUpgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-11Upgrade nodejsUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-develUpgrade graalvm22-ce-17-polyglotUpgrade nodejs-develUpgrade graalvm22-ce-11-llvmUpgrade npmUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-11-libpolyglotUpgrade nodejs-nodemonUpgrade graalvm22-ce-17-javascriptUpgrade nodejs-docsUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-11-fastr | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-debugsource | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-debuginfo | Mar 12, 2024 | Jul 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.4Upgrade Splunk Enterprise to version 8.2.10Upgrade Splunk Enterprise to version 8.1.13 | Sep 30, 2025 | Jul 14, 2022 |
| Suse | — | Upgrade nodejs18-docsUpgrade nodejs10-docsUpgrade nodejs16Upgrade nodejs12-develUpgrade nodejs18Upgrade nodejs10Upgrade npm18Upgrade nodejs12Upgrade nodejs14-docsUpgrade corepack16Upgrade npm12Upgrade nodejs12-docsUpgrade npm10Upgrade nodejs10-develUpgrade npm16Upgrade nodejs14Upgrade corepack18Upgrade nodejs16-develUpgrade nodejs16-docsUpgrade nodejs18-develUpgrade npm14Upgrade nodejs14-develUpgrade corepack14 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade libnode72Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-docUpgrade libnode-devUpgrade libnode64Upgrade nodejs | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub