CVE-2022-43548

CVE-2022-43548 affects Node.js and is caused by an insufficient IsAllowedHost check, allowing rebinding attacks via invalid IP addresses (notably octal formats) when using --inspect. Impact is DNS rebinding leading to potential code execution in affected environments. Affected versions include No...

CVE-2022-35256

CVE-2022-35256 concerns the llhttp parser used by Node.js (http module) where header fields not terminated with CRLF can enable HTTP Request Smuggling. The issue is present in Node.js builds that include the llhttp version affected and has been addressed by package updates in multiple distributio...

CVE-2022-21824

CVE-2022-21824 is a prototype pollution vulnerability in Node.js linked to console.table properties. It affects Node.js prior to patched releases and can be triggered when user-controlled data is passed as the first parameter with a plain object containing an own property such as proto . Public a...

CVE-2022-32212

CVE-2022-32212 is a Node.js OS Command Injection due to an insufficient IsAllowedHost validation, enabling rebinding attacks. Affected versions are Node.js <14.20.0, <16.20.0, and

CVE-2021-44531

CVE-2021-44531 affects Node.js and stems from improper handling of URI SAN types in X.509 certificate hostname verification. Older Node.js releases accepted URI SANs by default and could bypass name-constrained intermediates when PKIs aren’t defined for that SAN type; URI matching could also fail...

CVE-2022-35255

CVE-2022-35255 describes a weakness in Node.js 18 WebCrypto key generation where EntropySource() is invoked but its return value is not checked, and the data returned may not be cryptographically strong. The underlying issue occurs in SecretKeyGenTraits::DoKeyGen() and can lead to weaker key mate...

CVE-2021-44533

CVE-2021-44533 affects Node.js by improper handling of multi-value Relative Distinguished Names, potentially allowing bypass of certificate subject verification. Affected are Node.js versions < 12.22.9, < 14.18.3, < 16.13.2, and

CVE-2021-44532

CVE-2021-44532 affects Node.js where SAN handling converts Subject Alternative Names to a string to validate hostnames. The vulnerability allows bypass of certificate name constraints when present in a certificate chain. Affected versions include Node.js <12.22.9, <14.18.3, <16.13.2, and

CVE-2022-32213

CVE-2022-32213 concerns the llhttp parser in Node.js’ http module, where the parser may incorrectly parse and validate Transfer-Encoding headers, enabling HTTP Request Smuggling (HRS). The vulnerability is cited in multiple advisories (Debian, Red Hat, and Amazon Linux family) as part of a set in...

CVE-2022-32215

CVE-2022-32215 concerns the llhttp parser used by Node.js. The http module can mis-handle multi-line Transfer-Encoding headers in vulnerable builds, enabling HTTP Request Smuggling (HRS). Affected are Node.js ships with llhttp < v14.20.1, < v16.17.1, and

CVE-2022-32214

CVE-2022-32214 affects the Node.js http module via the llhttp parser, where versions <14.20.1, <16.17.1, and =14.20.1, >=16.17.1, >=18.9.1 or newer Node.js releases that bundle these llhttp versions). If exploitation details or CVSS changes are needed, refer to the linked advisories i...

CVE-2022-32223

CVE-2022-32223 is a Node.js DLL hijacking issue on Windows. When the system has OpenSSL and an openssl.cnf at C:\Program Files\Common Files\SSL\openssl.cnf, node.exe may search for providers.dll in the user directory and via the Windows DLL search order, enabling a local attacker to place a malic...