8.1
High
CVE-2022-43548 A OS Command Injection vulnerability exists in Node.js…
Description
A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Node 19.0 | 19.0 → < 19.0.1 | 19.0.1 |
| Node 18.0 | 18.0 → < 18.12.1 | 18.12.1 |
| Node 17.0 | 17.0 → latest | No fix stated |
| Node 16.0 | 16.0 → < 16.18.1 | 16.18.1 |
| Node 15.0 | 15.0 → latest | No fix stated |
| Node 14.0 | 14.0 → < 14.21.1 | 14.21.1 |
| Node 13.0 | 13.0 → latest | No fix stated |
| Node 12.0 | 12.0 → latest | No fix stated |
| Node 11.0 | 11.0 → latest | No fix stated |
Show the 7 other branches Hide the 7 other branches
References
- nodejs.org nodejs.org
- security.netapp.com security.netapp.com
- DSA-5326 www.debian.org
- [debian-lts-announce] 20230226 [SECURITY] [DLA 3344-1] nodejs security update lists.debian.org
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of Node
The 129 CVEs of Node →
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Medium
CVE-2026-106072
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when…
6.7
Medium
CVE-2026-106069
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP…
7.4
High
CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard…
3.6
Low