CVE-2022-43548

HIGH

Node.js <14.21.1, <16.18.1, <18.12.1, <19.0.1 - Command Injection

Title source: llm
STIX 2.1

Description

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Scores

CVSS v3 8.1
EPSS 0.0056
EPSS Percentile 68.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (6)
debian/debian_linux 10.0
debian/debian_linux 11.0
nodejs/node.js 18.12.0
nodejs/node.js 19.0.0
nodejs/node.js 14.0.0 - 14.14.0
nodejs/node.js 14.15.0 - 14.21.1
Published Dec 05, 2022
Tracked Since Feb 18, 2026