A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade nodejsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-docs | Oct 11, 2022 | Jul 14, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade v8-develUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade npmUpgrade nodejs-full-i18n | Feb 17, 2025 | Jul 8, 2022 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging | Oct 20, 2022 | Jul 14, 2022 |
| Debian | — | Upgrade nodejs | Oct 7, 2022 | Jul 14, 2022 |
| Freebsd | — | Upgrade node14Upgrade nodeUpgrade node16 | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-11Upgrade graalvm22-ce-17-libpolyglotUpgrade nodejsUpgrade graalvm22-ce-17-native-imageUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-17-fastrUpgrade nodejs-packagingUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-11-toolsUpgrade nodejs-libsUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-17-nodejsUpgrade nodejs-full-i18nUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-17Upgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-11-develUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-11-libpolyglotUpgrade nodejs-docsUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-11-espressoUpgrade nodejs-nodemonUpgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-17-polyglotUpgrade nodejs-develUpgrade npmUpgrade graalvm22-ce-11-python-devel | Sep 15, 2022 | Jul 8, 2022 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade npmUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-debugsource | Oct 20, 2022 | Jul 14, 2022 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade npmUpgrade nodejs-debuginfo | Mar 12, 2024 | Jul 14, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.13Upgrade Splunk Enterprise to version 8.2.10Upgrade Splunk Enterprise to version 9.0.4 | Sep 30, 2025 | Jul 14, 2022 |
| Suse | — | Upgrade npm18Upgrade nodejs10Upgrade npm12Upgrade nodejs12Upgrade nodejs18-docsUpgrade nodejs10-docsUpgrade nodejs12-develUpgrade corepack16Upgrade nodejs16Upgrade nodejs14-docsUpgrade nodejs18Upgrade corepack14Upgrade nodejs16-docsUpgrade nodejs18-develUpgrade nodejs14-develUpgrade npm10Upgrade npm14Upgrade nodejs14Upgrade nodejs16-develUpgrade npm16Upgrade corepack18Upgrade nodejs10-develUpgrade nodejs12-docs | Oct 26, 2022 | Jul 14, 2022 |
| Ubuntu | — | Upgrade nodejsUpgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-docUpgrade libnode64Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode72Upgrade nodejs (Ubuntu Pro) | Nov 22, 2023 | Jul 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub