Node.js: All versions prior to Node.js 6.15.0 8.14.0 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname they may be incorrect.

🗓️ 06 Jun 2021 07:00:00Reported by MicrosoftType

Node.js before 6.15.0, 8.14.0, 10.14.0, 11.3.0: url.parse() javascript hostname spoofing can mislead security decisions.

Reporter	Title	Published	Views	Family All 116
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private - Node.js	11 Mar 201914:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect has addressed multiple vulnerabilities in Developer Portal's dependencies - Cumulative list from June 28, 2018 to December 13, 2018	28 Jan 201917:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management V2018	13 May 201923:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software	29 Jan 201921:10	–	ibm
IBM Security Bulletins	Security Bulletin: API Connect is impacted by multiple nodeJS vulnerabilities (CVE-2018-12122 CVE-2018-12121 CVE-2018-12123 CVE-2018-12116)	27 Mar 201922:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by Node.js vulnerabilities	29 Mar 201910:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud Transformation Advisor	5 Dec 202219:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Local is affected by multiple vulnerabilities (CVE-2018-12116, CVE-2018-12121, CVE-2018-12122, CVE-2018-12123)	15 Apr 201915:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in Node.js affect IBM Voice Gateway	20 Feb 201918:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management V2018	3 May 201914:35	–	ibm

Vulners

Node

microsoft cm1_nodejs_14.17.2-1Range<14.17.2-1

06 Jun 2021 07:00Current

9.3High risk

Vulners AI Score9.3

CVSS 3.14.3

CVSS 24.3

EPSS0.03942