A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejsUpgrade npmUpgrade nodejs-libs | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade v8-develUpgrade nodejs-libs-debuginfoUpgrade nodejs | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade npmUpgrade nodejsUpgrade nodejs-libs | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Oct 7, 2022 | Jul 14, 2022 |
| Freebsd | — | Upgrade node14Upgrade nodeUpgrade node16 | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-11Upgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-17-nodejsUpgrade nodejs-libsUpgrade graalvm22-ce-17-pythonUpgrade nodejs-full-i18nUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-11-polyglotUpgrade nodejsUpgrade graalvm22-ce-17-jdkUpgrade nodejs-packagingUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-develUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-17-rubyUpgrade nodejs-develUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-11-espressoUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-17-polyglotUpgrade npm | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade npmUpgrade nodejs-libs-debuginfoUpgrade nodejs-devel | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs | Mar 12, 2024 | Jul 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.10Upgrade Splunk Enterprise to version 9.0.4Upgrade Splunk Enterprise to version 8.1.13 | Sep 30, 2025 | Jul 14, 2022 |
| Suse | — | Upgrade nodejs18-develUpgrade nodejs16-develUpgrade nodejs14Upgrade npm16Upgrade nodejs14-develUpgrade nodejs10-develUpgrade npm10Upgrade corepack18Upgrade nodejs12-docsUpgrade nodejs16-docsUpgrade corepack14Upgrade npm14Upgrade nodejs14-docsUpgrade nodejs16Upgrade nodejs10-docsUpgrade nodejs12Upgrade nodejs18Upgrade corepack16Upgrade nodejs10Upgrade npm18Upgrade nodejs12-develUpgrade npm12Upgrade nodejs18-docs | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade libnode72Upgrade libnode64Upgrade nodejsUpgrade nodejs-doc (Ubuntu Pro)Upgrade libnode-devUpgrade nodejs-docUpgrade nodejs-dev (Ubuntu Pro) | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub