A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libs | Dec 9, 2022 | Dec 5, 2022 |
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Dec 5, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade v8-devel | Feb 17, 2025 | Nov 4, 2022 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs | Dec 7, 2022 | Dec 5, 2022 |
| Debian | — | Upgrade nodejs | Jan 26, 2023 | Dec 5, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Dec 5, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-17-jdkUpgrade nodejs-full-i18nUpgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-11Upgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-17-native-imageUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade graalvm22-ce-11-develUpgrade nodejsUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-jdkUpgrade nodejs-packaging-bundlerUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade nodejs-docsUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-17-fastrUpgrade nodejs-nodemonUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-17-develUpgrade npmUpgrade graalvm22-ce-11-fastrUpgrade nodejs-develUpgrade graalvm22-ce-11-llvm-toolchain | Dec 8, 2022 | Nov 4, 2022 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-packaging | Dec 7, 2022 | Dec 5, 2022 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-libs-debuginfo | Mar 12, 2024 | Dec 5, 2022 |
| Suse | — | Upgrade corepack16Upgrade nodejs12Upgrade nodejs14-docsUpgrade nodejs10Upgrade nodejs16-docsUpgrade npm18Upgrade npm14Upgrade nodejs12-develUpgrade npm16Upgrade corepack18Upgrade nodejs18-develUpgrade nodejs14-develUpgrade corepack14Upgrade npm10Upgrade nodejs18-docsUpgrade nodejs10-docsUpgrade nodejs18Upgrade nodejs10-develUpgrade npm12Upgrade nodejs12-docsUpgrade nodejs16Upgrade nodejs16-develUpgrade nodejs14 | Nov 15, 2022 | Nov 14, 2022 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode64Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-docUpgrade libnode72Upgrade nodejsUpgrade libnode-dev | Nov 22, 2023 | Dec 5, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub