A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.
CVSS Details
- CVSS 3.0 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packaging | Aug 28, 2024 | Jul 9, 2024 |
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Jul 9, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs20-docsUpgrade nodejs20Upgrade nodejs20-full-i18nUpgrade nodejs20-debuginfoUpgrade nodejs20-debugsourceUpgrade nodejs20-libsUpgrade nodejs20-npmUpgrade v8-11.3-develUpgrade nodejs20-develUpgrade nodejs20-libs-debuginfo | Feb 17, 2025 | Jul 9, 2024 |
| Debian | — | Upgrade nodejs | May 15, 2025 | Jul 9, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Jul 9, 2024 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-full-i18n | Oct 16, 2024 | Jul 9, 2024 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade npmUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs | Sep 13, 2024 | Jul 9, 2024 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejsUpgrade npm | Sep 17, 2024 | Jul 9, 2024 |
| Suse | — | Upgrade npm18Upgrade nodejs18-develUpgrade nodejs18-docsUpgrade nodejs22-develUpgrade npm22Upgrade nodejs20Upgrade corepack22Upgrade corepack18Upgrade nodejs20-docsUpgrade corepack20Upgrade nodejs22-docsUpgrade nodejs18Upgrade nodejs20-develUpgrade npm20Upgrade nodejs22 | Jul 17, 2024 | Jul 9, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jul 9, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub