A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-libsUpgrade npm | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade v8-develUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade npmUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debugsource | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Oct 7, 2022 | Jul 14, 2022 |
| Freebsd | — | Upgrade node16Upgrade node14Upgrade node | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-11-wasmUpgrade nodejs-develUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-17-llvmUpgrade nodejs-nodemonUpgrade graalvm22-ce-17-rubyUpgrade npmUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-17-nodejs-develUpgrade nodejs-docsUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-11-javascriptUpgrade nodejs-libsUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-11Upgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-11-pythonUpgrade nodejs-full-i18nUpgrade graalvm22-ce-11-jdkUpgrade nodejsUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-develUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-toolsUpgrade nodejs-packagingUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-17-nodejs | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-devel | Mar 12, 2024 | Jul 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.13Upgrade Splunk Enterprise to version 9.0.4Upgrade Splunk Enterprise to version 8.2.10 | Sep 30, 2025 | Jul 14, 2022 |
| Suse | — | Upgrade corepack18Upgrade nodejs12-docsUpgrade npm14Upgrade npm10Upgrade nodejs16-develUpgrade nodejs14-develUpgrade nodejs10-develUpgrade npm16Upgrade nodejs14Upgrade nodejs18-develUpgrade corepack14Upgrade nodejs16-docsUpgrade npm18Upgrade nodejs10-docsUpgrade nodejs10Upgrade nodejs16Upgrade nodejs12-develUpgrade nodejs12Upgrade nodejs14-docsUpgrade corepack16Upgrade nodejs18-docsUpgrade npm12Upgrade nodejs18 | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade nodejs-docUpgrade nodejs-doc (Ubuntu Pro)Upgrade libnode64Upgrade libnode-devUpgrade nodejs-dev (Ubuntu Pro)Upgrade nodejsUpgrade nodejs (Ubuntu Pro)Upgrade libnode72 | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub