Every CVE Search/ Get API key

CVE-2021-33502

ReDoS in normalize-url

7.5 HighFix available

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.70%Up 1.2 points since May 25, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Record
CVE-2021-33502
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-1333
Updated
2026-11-02
CVE List No score

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Record
CVE-2021-33502
Updated
2026-11-02
EUVDEUVD-2021-1374 No score

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Record
EUVD-2021-1374
Updated
2026-11-03
GitHub AdvisoriesGHSA-px4h-xg32-q955 7.5

ReDoS in normalize-url

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Record
GHSA-px4h-xg32-q955
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVAZL-44850 7.5

CVE-2021-33502 affecting package nodejs-nodemon 2.0.3-5

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Record
AZL-44850
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSV 7.5

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Record
CVE-2021-33502
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 16 moreShow less
OSVDEBIAN-CVE-2021-33502 7.5

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Record
DEBIAN-CVE-2021-33502
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-px4h-xg32-q955 7.5

ReDoS in normalize-url

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Record
GHSA-px4h-xg32-q955
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVRHSA-2021:2931 7.5

Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update

Record
RHSA-2021:2931
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:2932 7.5

Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

Record
RHSA-2021:2932
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:5171 9.8

Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Record
RHSA-2021:5171
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0246 9.8

Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Record
RHSA-2022:0246
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0350 9.8

Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Record
RHSA-2022:0350
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:4711 7.5

Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.0] security update

Record
RHSA-2022:4711
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:6595 7.5

Red Hat Security Advisory: nodejs and nodejs-nodemon security and bug fix update

Record
RHSA-2022:6595
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:5171 9.8

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.13.1), nodejs-nodemon (2.0.15). (BZ#2027610)

Security Fix(es):

  • nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

  • llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:5171
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:0350 9.8

Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027609)

Security Fix(es):

  • nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)

  • nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)

  • llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

  • llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:0350
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:6595 7.5

Moderate: nodejs and nodejs-nodemon security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)

Security Fix(es):

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)

  • nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

  • nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

  • nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

  • nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

  • got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [Rocky Linux-9] (BZ#2121019)

  • nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)

Record
RLSA-2022:6595
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-33502 7.5

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Record
UBUNTU-CVE-2021-33502
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2021:5171 No score

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.13.1), nodejs-nodemon (2.0.15). (BZ#2027610)

Security Fix(es):

  • nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

  • llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2021:5171
Updated
2026-11-02
OSVALSA-2022:0350 No score

Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.18.2), nodejs-nodemon (2.0.15). (BZ#2027609)

Security Fix(es):

  • nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  • normalize-url: ReDoS for data URLs (CVE-2021-33502)

  • nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37701)

  • nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links allowing arbitrary file creation and overwrite (CVE-2021-37712)

  • llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

  • llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2022:0350
Updated
2026-11-02
OSVALSA-2022:6595 No score

Moderate: nodejs and nodejs-nodemon security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)

Security Fix(es):

  • nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)
  • nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)
  • nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
  • normalize-url: ReDoS for data URLs (CVE-2021-33502)
  • nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)
  • nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)
  • nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)
  • nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)
  • nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)
  • got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [almalinux-9] (BZ#2121019)
  • nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)
Record
ALSA-2022:6595
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
normalize-url
npm
 5.0.0 up to 5.3.1
5.3.1
normalize-url
npm
 6.0.0 up to 6.0.1
6.0.1
normalize-url
npm
 4.3.0 up to 4.5.1
4.5.1
nodejs
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module_el8.5.0+2605+45d748af
1:16.13.1-3.module_el8.5.0+2605+45d748af
nodejs
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module_el8.5.0+246+05401605
1:16.13.1-3.module_el8.5.0+246+05401605
nodejs-devel
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module_el8.5.0+2605+45d748af
1:16.13.1-3.module_el8.5.0+2605+45d748af
nodejs-devel
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module_el8.5.0+246+05401605
1:16.13.1-3.module_el8.5.0+246+05401605
nodejs-docs
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module_el8.5.0+2605+45d748af
1:16.13.1-3.module_el8.5.0+2605+45d748af
nodejs-docs
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module_el8.5.0+246+05401605
1:16.13.1-3.module_el8.5.0+246+05401605
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module_el8.5.0+2605+45d748af
1:16.13.1-3.module_el8.5.0+2605+45d748af
Show 125 moreShow less
Affected packages
PackageAffectedFixed
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module_el8.5.0+246+05401605
1:16.13.1-3.module_el8.5.0+246+05401605
nodejs-nodemon
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2.0.15-1.module_el8.6.0+2904+f21ad6f4
2.0.15-1.module_el8.6.0+2904+f21ad6f4
nodejs-nodemon
AlmaLinux:8
From an advisory covering 7 CVEs
 before 2.0.15-1.module_el8.5.0+2605+45d748af
2.0.15-1.module_el8.5.0+2605+45d748af
nodejs-packaging
AlmaLinux:8
From an advisory covering 7 CVEs
 before 25-1.module_el8.5.0+246+05401605
25-1.module_el8.5.0+246+05401605
nodejs-packaging
AlmaLinux:8
From an advisory covering 7 CVEs
 before 25-1.module_el8.5.0+2605+45d748af
25-1.module_el8.5.0+2605+45d748af
npm
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:8.1.2-1.16.13.1.3.module_el8.5.0+2605+45d748af
1:8.1.2-1.16.13.1.3.module_el8.5.0+2605+45d748af
npm
AlmaLinux:8
From an advisory covering 7 CVEs
 before 1:8.1.2-1.16.13.1.3.module_el8.5.0+246+05401605
1:8.1.2-1.16.13.1.3.module_el8.5.0+246+05401605
nodejs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
1:14.18.2-2.module_el8.5.0+2618+8d46dafd
nodejs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+254+b4526b16
1:14.18.2-2.module_el8.5.0+254+b4526b16
nodejs-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
1:14.18.2-2.module_el8.5.0+2618+8d46dafd
nodejs-devel
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+254+b4526b16
1:14.18.2-2.module_el8.5.0+254+b4526b16
nodejs-docs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
1:14.18.2-2.module_el8.5.0+2618+8d46dafd
nodejs-docs
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+254+b4526b16
1:14.18.2-2.module_el8.5.0+254+b4526b16
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+2618+8d46dafd
1:14.18.2-2.module_el8.5.0+2618+8d46dafd
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module_el8.5.0+254+b4526b16
1:14.18.2-2.module_el8.5.0+254+b4526b16
nodejs-nodemon
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2.0.15-1.module_el8.6.0+2904+f21ad6f4
2.0.15-1.module_el8.6.0+2904+f21ad6f4
nodejs-nodemon
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2.0.15-1.module_el8.5.0+2605+45d748af
2.0.15-1.module_el8.5.0+2605+45d748af
nodejs-nodemon
AlmaLinux:8
From an advisory covering 9 CVEs
 before 2.0.15-1.module_el8.5.0+2618+8d46dafd
2.0.15-1.module_el8.5.0+2618+8d46dafd
nodejs-packaging
AlmaLinux:8
From an advisory covering 9 CVEs
 before 23-3.module_el8.5.0+2618+8d46dafd
23-3.module_el8.5.0+2618+8d46dafd
nodejs-packaging
AlmaLinux:8
From an advisory covering 9 CVEs
 before 23-3.module_el8.4.0+2522+3bd42762
23-3.module_el8.4.0+2522+3bd42762
npm
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd
1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd
npm
AlmaLinux:8
From an advisory covering 9 CVEs
 before 1:6.14.15-1.14.18.2.2.module_el8.5.0+254+b4526b16
1:6.14.15-1.14.18.2.2.module_el8.5.0+254+b4526b16
nodejs
AlmaLinux:9
From an advisory covering 10 CVEs
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-docs
AlmaLinux:9
From an advisory covering 10 CVEs
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 10 CVEs
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-libs
AlmaLinux:9
From an advisory covering 10 CVEs
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-nodemon
AlmaLinux:9
From an advisory covering 10 CVEs
 before 2.0.19-1.el9_0
2.0.19-1.el9_0
npm
AlmaLinux:9
From an advisory covering 10 CVEs
 before 1:8.11.0-1.16.16.0.1.el9_0
1:8.11.0-1.16.16.0.1.el9_0
nodejs-nodemon
Azure Linux:3
 through 2.0.3-5 None known
node-got
Debian:12
 before 11.8.1+~cs53.13.17-3
11.8.1+~cs53.13.17-3
node-got
Debian:13
 before 11.8.1+~cs53.13.17-3
11.8.1+~cs53.13.17-3
node-got
Debian:14
 before 11.8.1+~cs53.13.17-3
11.8.1+~cs53.13.17-3
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.22.2-1.el7
0:12.22.2-1.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.22.2-1.el7
0:12.22.2-1.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.22.2-1.el7
0:12.22.2-1.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:12.22.2-1.el7
0:12.22.2-1.el7
rh-nodejs12-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:2.0.3-2.el7
0:2.0.3-2.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:6.14.13-12.22.2.1.el7
0:6.14.13-12.22.2.1.el7
rh-nodejs14-nodejs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:14.17.2-1.el7
0:14.17.2-1.el7
rh-nodejs14-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:14.17.2-1.el7
0:14.17.2-1.el7
rh-nodejs14-nodejs-devel
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:14.17.2-1.el7
0:14.17.2-1.el7
rh-nodejs14-nodejs-docs
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:14.17.2-1.el7
0:14.17.2-1.el7
rh-nodejs14-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:2.0.3-2.el7
0:2.0.3-2.el7
rh-nodejs14-npm
Red Hat:rhel_software_collections:3::el7
From an advisory covering 4 CVEs
 before 0:6.14.13-14.17.2.1.el7
0:6.14.13-14.17.2.1.el7
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module+el8.5.0+13548+45d748af
1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module+el8.5.0+13548+45d748af
1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module+el8.5.0+13548+45d748af
1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module+el8.5.0+13548+45d748af
1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module+el8.5.0+13548+45d748af
1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module+el8.5.0+13548+45d748af
1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:2.0.15-1.module+el8.5.0+13548+45d748af
0:2.0.15-1.module+el8.5.0+13548+45d748af
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 0:25-1.module+el8.5.0+10992+fac5fe06
0:25-1.module+el8.5.0+10992+fac5fe06
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 7 CVEs
 before 1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af
1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af
nodejs
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-debuginfo
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-debugsource
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-devel
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-docs
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-full-i18n
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
1:14.18.2-2.module+el8.4.0+13643+6c0ebf22
nodejs-nodemon
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 0:2.0.15-1.module+el8.4.0+13503+fc29810b
0:2.0.15-1.module+el8.4.0+13503+fc29810b
nodejs-packaging
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 0:23-3.module+el8.3.0+6519+9f98ed83
0:23-3.module+el8.3.0+6519+9f98ed83
npm
Red Hat:rhel_eus:8.4::appstream
From an advisory covering 9 CVEs
 before 1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22
1:6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:2.0.15-1.module+el8.5.0+13504+a2e74d91
0:2.0.15-1.module+el8.5.0+13504+a2e74d91
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:23-3.module+el8.3.0+6519+9f98ed83
0:23-3.module+el8.3.0+6519+9f98ed83
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd
1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd
ovirt-engine-ui-extensions
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:1.3.3-1.el8ev
0:1.3.3-1.el8ev
ovirt-web-ui
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:1.8.1-2.el8ev
0:1.8.1-2.el8ev
ovirt-engine
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-backend
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-dbscripts
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-health-check-bundler
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-restapi
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-setup
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-setup-base
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-setup-plugin-cinderlib
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-setup-plugin-imageio
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-setup-plugin-ovirt-engine
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-setup-plugin-ovirt-engine-common
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-setup-plugin-vmconsole-proxy-helper
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-setup-plugin-websocket-proxy
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-tools
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-tools-backup
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-vmconsole-proxy-helper
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-webadmin-portal
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
ovirt-engine-websocket-proxy
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
python3-ovirt-engine-lib
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
rhvm
Red Hat:rhev_manager:4.4:el8
From an advisory covering 6 CVEs
 before 0:4.5.0.7-0.9.el8ev
0:4.5.0.7-0.9.el8ev
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 0:2.0.19-1.el9_0
0:2.0.19-1.el9_0
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:16.16.0-1.el9_0
1:16.16.0-1.el9_0
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 10 CVEs
 before 1:8.11.0-1.16.16.0.1.el9_0
1:8.11.0-1.16.16.0.1.el9_0
nodejs
Rocky Linux:8
From an advisory covering 7 CVEs
 before 1:16.13.1-3.module+el8.5.0+721+4c107270
1:16.13.1-3.module+el8.5.0+721+4c107270
nodejs-nodemon
Rocky Linux:8
From an advisory covering 7 CVEs
 before 0:2.0.15-1.module+el8.5.0+721+4c107270
0:2.0.15-1.module+el8.5.0+721+4c107270
nodejs-packaging
Rocky Linux:8
From an advisory covering 7 CVEs
 before 0:25-1.module+el8.6.0+1046+80feca58
0:25-1.module+el8.6.0+1046+80feca58
nodejs-packaging
Rocky Linux:8
From an advisory covering 7 CVEs
 before 0:25-1.module+el8.5.0+702+221f14e6
0:25-1.module+el8.5.0+702+221f14e6
nodejs
Rocky Linux:8
From an advisory covering 9 CVEs
 before 1:14.18.2-2.module+el8.5.0+733+de4fee6c
1:14.18.2-2.module+el8.5.0+733+de4fee6c
nodejs-nodemon
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:2.0.15-1.module+el8.5.0+721+4c107270
0:2.0.15-1.module+el8.5.0+721+4c107270
nodejs-packaging
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:23-3.module+el8.7.0+1071+4bdda2a8
0:23-3.module+el8.7.0+1071+4bdda2a8
nodejs-packaging
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:23-3.module+el8.3.0+100+234774f7
0:23-3.module+el8.3.0+100+234774f7
nodejs-packaging
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:23-3.module+el8.5.0+733+de4fee6c
0:23-3.module+el8.5.0+733+de4fee6c
nodejs-nodemon
Rocky Linux:9
From an advisory covering 10 CVEs
 before 0:2.0.19-1.el9_0
0:2.0.19-1.el9_0
node-got
Ubuntu:18.04:LTS
 All versions, plus listed versions
7.1.0-1
 None known
node-got
Ubuntu:20.04:LTS
 All versions, plus listed versions
7.1.0-1
 None known
node-yarnpkg
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.13.0-1build11.13.0-31.19.1-11.22.4-2
 None known
node-got
Ubuntu:22.04:LTS
 All versions, plus listed versions
11.8.1+~cs53.13.17-311.8.2+~cs58.7.32-211.8.3+~cs58.7.37-1
 None known
node-yarnpkg
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.22.10+~cs22.25.14-31.22.10+~cs22.25.14-41.22.10+~cs22.25.14-51.22.10+~cs22.25.14-8
 None known
node-got
Ubuntu:24.04:LTS
 All versions, plus listed versions
11.8.5+~cs58.13.36-3
 None known
node-yarnpkg
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.22.19+~cs24.27.18-21.22.19+~cs24.27.18-4
 None known
node-got
Ubuntu:25.10
 All versions, plus listed versions
11.8.5+~cs58.13.36-5
 None known
node-yarnpkg
Ubuntu:25.10
 All versions, plus listed versions
4.0.2+dfsg-34.1.0+dfsg-1
 None known
node-got
Ubuntu:26.10
 All versions, plus listed versions
11.8.5+~cs58.13.36-611.8.5+~cs58.13.36-7
 None known
node-yarnpkg
Ubuntu:26.10
 All versions, plus listed versions
4.1.0+dfsg-14.1.0+dfsg-6ubuntu24.1.0+dfsg-7ubuntu1
 None known
node-got
Ubuntu:26.04:LTS
 All versions, plus listed versions
11.8.5+~cs58.13.36-511.8.5+~cs58.13.36-6
 None known
node-yarnpkg
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.1.0+dfsg-1
 None known

History

History
RecordedChangedSources
affected
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-33502 is a high vulnerability (CVSS 7.5) in Normalize-url Project Normalize-url, published May 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. Fixed in normalize-url 5.3.1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 44 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open