Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Aug 22, 2024 | Nov 28, 2018 |
| Debian | — | Upgrade nodejs | Jul 30, 2024 | Nov 28, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 3, 2023 |
| Freebsd | — | Upgrade node6Upgrade nodeUpgrade node8Upgrade node10 | Dec 10, 2018 | Dec 10, 2018 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Nov 28, 2018 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Nov 28, 2018 |
| Suse | — | Upgrade mozilla-nss-certs-32bitUpgrade libfirefox-gmodule-2_0-0Upgrade mozilla-nspr-32bitUpgrade firefox-atk-langUpgrade nodejs6Upgrade firefox-gio-branding-upstreamUpgrade libfirefox-glib-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libffi7Upgrade libfirefox-gthread-2_0-0Upgrade firefox-libgtk-3-0Upgrade nodejs6-develUpgrade firefox-gtk3-immodules-tigrignaUpgrade nodejs8Upgrade MozillaFirefox-branding-SLEDUpgrade libfreebl3-32bitUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-libpango-1_0-0Upgrade mozilla-nspr-develUpgrade npm8Upgrade nodejs8-develUpgrade firefox-glib2-toolsUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gdk-pixbuf-langUpgrade libfirefox-gobject-2_0-0Upgrade mozilla-nssUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gdk-pixbuf-query-loadersUpgrade MozillaFirefox-translations-commonUpgrade firefox-libffi4Upgrade mozilla-nsprUpgrade npm10Upgrade firefox-libcairo-gobject2Upgrade libfirefox-gio-2_0-0Upgrade libfreebl3Upgrade nodejs4Upgrade firefox-libharfbuzz0Upgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodule-ximUpgrade firefox-libcairo2Upgrade MozillaFirefoxUpgrade libsoftokn3-32bitUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-toolsUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-develUpgrade nodejs4-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade npm4Upgrade nodejs4-docsUpgrade firefox-glib2-langUpgrade npm6Upgrade nodejs6-docsUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nss-32bitUpgrade libsoftokn3Upgrade nodejs8-docsUpgrade firefox-gtk3-dataUpgrade mozilla-nss-certsUpgrade nodejs10-docsUpgrade nodejs10-develUpgrade firefox-gtk3-langUpgrade nodejs10 | Jan 31, 2019 | Nov 28, 2018 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-legacy (Ubuntu Pro) | Mar 22, 2023 | Nov 28, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub