Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | Nov 28, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Nov 28, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade node10Upgrade node8Upgrade node6Upgrade node | Dec 10, 2018 | Dec 10, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Nov 28, 2018 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Nov 28, 2018 |
| Suse | — | Upgrade mozilla-nsprUpgrade firefox-libcairo-gobject2Upgrade mozilla-nspr-develUpgrade MozillaFirefox-translations-commonUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libpango-1_0-0Upgrade nodejs6-develUpgrade firefox-glib2-toolsUpgrade mozilla-nspr-32bitUpgrade libfirefox-glib-2_0-0Upgrade libfirefox-gio-2_0-0Upgrade firefox-libffi4Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodule-thaiUpgrade mozilla-nssUpgrade firefox-gio-branding-upstreamUpgrade npm10Upgrade libfirefox-gthread-2_0-0Upgrade firefox-libffi7Upgrade libfreebl3Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-libgtk-3-0Upgrade nodejs4Upgrade firefox-gtk3-branding-upstreamUpgrade firefox-gdk-pixbuf-query-loadersUpgrade npm8Upgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-immodules-tigrignaUpgrade libfreebl3-32bitUpgrade libfirefox-gobject-2_0-0Upgrade nodejs8Upgrade nodejs8-develUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-atk-langUpgrade nodejs6Upgrade libsoftokn3Upgrade firefox-glib2-langUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs8-docsUpgrade firefox-gtk3-dataUpgrade nodejs6-docsUpgrade mozilla-nss-certsUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-toolsUpgrade nodejs10-develUpgrade libsoftokn3-32bitUpgrade npm6Upgrade firefox-libcairo2Upgrade firefox-gtk3-langUpgrade mozilla-nss-toolsUpgrade firefox-libharfbuzz0Upgrade nodejs10Upgrade firefox-gtk3-immodule-ximUpgrade firefox-libatk-1_0-0Upgrade nodejs10-docsUpgrade MozillaFirefoxUpgrade firefox-gtk3-immodule-amharicUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-develUpgrade mozilla-nss-32bitUpgrade nodejs4-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade npm4Upgrade nodejs4-docs | Jan 31, 2019 | Nov 28, 2018 |
| Ubuntu | — | Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro) | Mar 22, 2023 | Nov 28, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub