Read the docs
TI-2022-21328 Aliases CVE-2022-43548GHSA-r934-m2c7-26gh

OS command injection in NodeJS Node

Priority MEDIUM 53CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-78.

Summary

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.14839 96th percentileScored 2026-11-07
Fix Fixed Node (NodeJS): 14.21.1, 16.18.1, 18.12.1 +1Red Hat: 8 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSNode4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 to before 14.21.1; 15.0 and later; 16.0 to before 16.18.1; 17.0 and later; 18.0 to before 18.12.1; 19.0 to before 19.0.114.21.1, 16.18.1, 18.12.1, 19.0.1Patch availableCNA
  • Node VendorNodeJS Affected 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 to before 14.21.1; 15.0 and later; 16.0 to before 16.18.1; 17.0 and later; 18.0 to before 18.12.1; 19.0 to before 19.0.1 Fixed in 14.21.1, 16.18.1, 18.12.1, 19.0.1 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*14.0.0 – 14.14.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*14.15.0 to before 14.21.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*16.0.0 – 16.12.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*16.13.0 to before 16.18.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*18.0.0 – 18.11.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:18.12.0:*:*:*:lts:*:*:*18.12.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:19.0.0:*:*:*:-:*:*:*19.0.0VulnerableNodeJS
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 14.0.0 – 14.14.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 14.15.0 to before 14.21.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 16.0.0 – 16.12.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 16.13.0 to before 16.18.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 18.0.0 – 18.11.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:18.12.0:*:*:*:lts:*:*:* Versions 18.12.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:19.0.0:*:*:*:-:*:*:* Versions 19.0.0 Vulnerable ·NodeJS
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · CNA Node (NodeJS) Fixed in 14.21.1, 16.18.1, 18.12.1, 19.0.1

Red Hat 8 advisories

  • RHSA-2023:1742 Released 2023-04-12 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.6.0+18532+cbe6f646.s390x::nodejs:14 +19
  • RHSA-2023:1533 Released 2023-03-30 · Red Hat rating Important
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.aarch64::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.ppc64le::nodejs:14, nodejs-1:14.21.3-1.module+el8.4.0+18317+43f5ac16.s390x::nodejs:14 +19
  • RHSA-2023:0612 Released 2023-02-06 · Red Hat rating Moderate
    rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
    • Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-14.21.1-3.el7, rh-nodejs14-nodejs-devel-14.21.1-3.el7, rh-nodejs14-nodejs-docs-14.21.1-3.el7 +3
Show 5 more Red Hat advisories
  • RHSA-2023:0321 Released 2023-01-23 · Red Hat rating Moderate
    nodejs and nodejs-nodemon security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.18.1-3.el9_1, nodejs-docs-1:16.18.1-3.el9_1, nodejs-full-i18n-1:16.18.1-3.el9_1 +3
  • RHSA-2023:0050 Released 2023-01-09 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.aarch64::nodejs:14, nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.ppc64le::nodejs:14, nodejs-1:14.21.1-2.module+el8.7.0+17528+a329cd47.s390x::nodejs:14 +19
  • RHSA-2022:9073 Released 2022-12-15 · Red Hat rating Moderate
    nodejs:16 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.aarch64::nodejs:16, nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.ppc64le::nodejs:16, nodejs-1:16.18.1-3.module+el8.7.0+17465+1a1abd74.s390x::nodejs:16 +19
  • RHSA-2022:8833 Released 2022-12-06 · Red Hat rating Moderate
    nodejs:18 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.aarch64::nodejs:18, nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.ppc64le::nodejs:18, nodejs-1:18.12.1-2.module+el8.7.0+17306+fc023f99.s390x::nodejs:18 +20
  • RHSA-2022:8832 Released 2022-12-06 · Red Hat rating Moderate
    nodejs:18 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.aarch64::nodejs:18, nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.ppc64le::nodejs:18, nodejs-1:18.12.1-1.module+el9.1.0.z+17326+318294bb.s390x::nodejs:18 +20

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:8833, RHSA-2022:9073, RHSA-2023:0050
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:8832, RHSA-2023:0321
Red Hat Enterprise Linux AppStream EUS (v.8.4)Fixed RHSA-2023:1533
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2023:1742
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2023:0612
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2023:0612
Not affected: 1 product
  • Red Hat Enterprise Linux AppStream (v. 9)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43548
  2. 2026-10-03 Alias added: GHSA-r934-m2c7-26gh

References

Patch 1

Advisory 3

Other 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
  • TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
  • TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
  • TI-2022-03315 X.509 Email Address 4-byte Buffer Overflow CVSS 3.1HIGH 7.5
See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences