Read the docs
TI-2022-13932 Aliases CVE-2022-32223GHSA-fxjx-rf8x-pxw8

Uncontrolled search path in NodeJS Node

Priority LOW 36CWE-427Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.

Why it matters now

EPSS 0.01752 78th percentileScored 2026-11-07
Fix Fixed Node (NodeJS): 14.20.0, 16.20.0, 18.5.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSNode4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 to before 14.20.0; 15.0 and later; 16.0 to before 16.20.0; 17.0 and later; 18.0 to before 18.5.014.20.0, 16.20.0, 18.5.0Patch availableCNA
  • Node VendorNodeJS Affected 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 to before 14.20.0; 15.0 and later; 16.0 to before 16.20.0; 17.0 and later; 18.0 to before 18.5.0 Fixed in 14.20.0, 16.20.0, 18.5.0 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*14.0.0 – 14.14.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*14.14.0 to before 14.20.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*16.0.0 – 16.12.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*16.13.0 to before 16.16.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*18.0.0 to before 18.0.5VulnerableNodeJS
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 14.0.0 – 14.14.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 14.14.0 to before 14.20.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 16.0.0 – 16.12.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 16.13.0 to before 16.16.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 18.0.0 to before 18.0.5 Vulnerable ·NodeJS
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA Node (NodeJS) Fixed in 14.20.0, 16.20.0, 18.5.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    NodeJS Node 10.*, 11.* and 13 more versions

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2022-13924 The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does…Priority HIGH 69
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-32223
  2. 2026-10-03 Alias added: GHSA-fxjx-rf8x-pxw8

References

Patch 1

Advisory 1

Other 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
  • TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
  • TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
  • TI-2022-03315 X.509 Email Address 4-byte Buffer Overflow CVSS 3.1HIGH 7.5
See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences