Read the docs
TI-2022-03647 Aliases CVE-2022-3978GHSA-5gwx-wf9g-r5mx

NodeBB abort cross-site request forgery

Priority MEDIUM 53CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass, Tampering
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863 and CWE-352.

Summary

A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.5.8 is able to address this issue. The name of the patch is 2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-213555.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nodebb (npm): 2.5.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
unspecifiedNodeBB2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; 2.5.6; 2.5.7—No fix listedCNA
—nodebb (npm)before 2.5.82.5.8Patch availableGHSA-5gwx-wf9g-r5mx
  • NodeBB Vendorunspecified Affected 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; 2.5.6; 2.5.7 Fixed in — No fix listed CNA
  • nodebb (npm) Vendor— Affected before 2.5.8 Fixed in 2.5.8 Patch available GHSA-5gwx-wf9g-r5mx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:*before 2.5.8VulnerableNodeBB
  • cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:* Versions before 2.5.8 Vulnerable ·NodeBB

Remediation

  • Fix · GHSA-5gwx-wf9g-r5mx nodebb (npm) Fixed in 2.5.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3978
  2. 2026-10-03 Alias added: GHSA-5gwx-wf9g-r5mx

References

Exploit 1

Patch 1

Advisory 2

  • TI-2023-23124 A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc… CVSS 3.1CRITICAL 9.8
  • TI-2022-22808 Account takeover via prototype vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-42173 NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User CVSS 4.0HIGH 8.7
  • TI-2025-32286 NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint… CVSS 3.1HIGH 8.6
  • TI-2023-14416 NodeBB Pre-Authentication Denial-of-Service CVSS 3.1HIGH 7.5
  • TI-2022-16499 Account takeover via SSO plugins in NodeBB CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences