7.4 High

CVE-2022-25906 All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other…

Description

All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function.

Affected products and versions

Product	Affected versions	Fixed in
is-http2	Versions not published

Do you use is-http2?

Track this CVE Watch is-http2 Check my SBOMs

www.cveye.io/en/cve/CVE-2022-25906

Timeline

Published February 1, 2023
Last modified March 26, 2025

References

security.snyk.io security.snyk.io
github.com github.com

Track this CVE