Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Aug 22, 2024 | Nov 28, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Nov 28, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade nodeUpgrade node8Upgrade node6Upgrade node10 | Dec 10, 2018 | Dec 10, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Nov 28, 2018 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Nov 28, 2018 |
| Suse | — | Upgrade libfreebl3Upgrade nodejs8Upgrade nodejs8-develUpgrade mozilla-nsprUpgrade MozillaFirefox-translations-commonUpgrade mozilla-nspr-32bitUpgrade libfirefox-glib-2_0-0Upgrade firefox-libgtk-3-0Upgrade npm8Upgrade nodejs4Upgrade firefox-gdk-pixbuf-query-loadersUpgrade nodejs6-develUpgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-libcairo-gobject2Upgrade libfirefox-gmodule-2_0-0Upgrade libfirefox-gio-2_0-0Upgrade npm10Upgrade firefox-atk-langUpgrade mozilla-nssUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-libffi4Upgrade firefox-libpango-1_0-0Upgrade firefox-glib2-toolsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfreebl3-32bitUpgrade firefox-gdk-pixbuf-langUpgrade MozillaFirefox-branding-SLEDUpgrade libfirefox-gthread-2_0-0Upgrade nodejs6Upgrade firefox-libffi7Upgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodules-tigrignaUpgrade nodejs10Upgrade nodejs10-develUpgrade MozillaFirefoxUpgrade firefox-gtk3-toolsUpgrade libsoftokn3-32bitUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs6-docsUpgrade firefox-glib2-langUpgrade nodejs4-docsUpgrade nodejs4-develUpgrade mozilla-nss-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade npm4Upgrade MozillaFirefox-translations-otherUpgrade nodejs10-docsUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodule-multipressUpgrade nodejs8-docsUpgrade firefox-gtk3-immodule-ximUpgrade firefox-libharfbuzz0Upgrade firefox-libcairo2Upgrade firefox-gtk3-langUpgrade mozilla-nss-toolsUpgrade firefox-libatk-1_0-0Upgrade mozilla-nss-certsUpgrade firefox-gtk3-dataUpgrade libsoftokn3Upgrade npm6Upgrade mozilla-nss-32bit | Jan 31, 2019 | Nov 28, 2018 |
| Ubuntu | — | Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro) | Mar 22, 2023 | Nov 28, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub