CVE-2022-33987

Got allows a redirect to a UNIX socket

5.3 MediumFix available

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

2.42%Up 1.5 points since Jun 19, 2022

What each source reports

NVD Score used 5.3

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Record: CVE-2022-33987
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Record: CVE-2022-33987
Updated: 2026-11-02

EUVDEUVD-2022-6110 No score

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Record: EUVD-2022-6110
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pfrx-2q88-qq97 5.3

Got allows a redirect to a UNIX socket

The got package before 11.8.5 and 12.1.0 for Node.js allows a redirect to a UNIX socket.

Record: GHSA-pfrx-2q88-qq97
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-33987 5.3

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Record: DEBIAN-CVE-2022-33987
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-03

OSVGHSA-pfrx-2q88-qq97 5.3

Got allows a redirect to a UNIX socket

The got package before 11.8.5 and 12.1.0 for Node.js allows a redirect to a UNIX socket.

Record: GHSA-pfrx-2q88-qq97
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Show 19 moreShow less

OSVRHSA-2022:6389 7.5

Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security and bug fix update

Record: RHSA-2022:6389
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6448 7.5

Red Hat Security Advisory: nodejs:14 security and bug fix update

Record: RHSA-2022:6448
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6449 7.5

Red Hat Security Advisory: nodejs:16 security and bug fix update

Record: RHSA-2022:6449
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6595 7.5

Red Hat Security Advisory: nodejs and nodejs-nodemon security and bug fix update

Record: RHSA-2022:6595
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2022:6985 7.5

Red Hat Security Advisory: nodejs:14 security and bug fix update

Record: RHSA-2022:6985
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2022:6448 7.5

Moderate: nodejs:14 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)
nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)
nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)
nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)
got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

nodejs:14/nodejs: rebase to latest upstream release (BZ#2106367)
nodejs:14/nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2111417)

Record: RLSA-2022:6448
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2022:6449 7.5

Moderate: nodejs:16 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)
nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)
nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)
nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)
got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

nodejs:16/nodejs: rebase to latest upstream release (BZ#2106369)
nodejs:16/nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2111416)

Record: RLSA-2022:6449
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2022:6595 7.5

Moderate: nodejs and nodejs-nodemon security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)

Security Fix(es):

nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)
nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)
nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
normalize-url: ReDoS for data URLs (CVE-2021-33502)
nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)
nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)
nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)
nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)
nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)
got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [Rocky Linux-9] (BZ#2121019)
nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)

Record: RLSA-2022:6595
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-APP-NPM-CVE-2022-33987 5.3

CVE-2022-33987 in @rootio/got - Patched by Root

Root has patched CVE-2022-33987 in the @rootio/got package for Root:npm. Multiple fixed versions available.

Record: ROOT-APP-NPM-CVE-2022-33987
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-33987 5.3

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Record: UBUNTU-CVE-2022-33987
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVALSA-2022:6448 No score

Moderate: nodejs:14 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)
nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)
nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)
nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)
got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

nodejs:14/nodejs: rebase to latest upstream release (BZ#2106367)
nodejs:14/nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2111417)

Record: ALSA-2022:6448
Updated: 2026-11-02

OSVALSA-2022:6595 No score

Moderate: nodejs and nodejs-nodemon security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)

Security Fix(es):

nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)
nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)
nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
normalize-url: ReDoS for data URLs (CVE-2021-33502)
nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)
nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)
nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)
nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)
nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)
got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [almalinux-9] (BZ#2121019)
nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)

Record: ALSA-2022:6595
Updated: 2026-11-02

OSVCLSA-2026-1771891819 No score

TuxCare security update for got (1 CVE)

TuxCare rebuilt got to address 1 CVE. Fixed in 8.3.2-tuxcare.1.

Record: CLSA-2026-1771891819
Updated: 2026-11-02

OSVCLSA-2026-1773188113 No score

TuxCare security update for got (1 CVE)

TuxCare rebuilt got to address 1 CVE. Fixed in 9.6.0-tuxcare.1.

Record: CLSA-2026-1773188113
Updated: 2026-11-02

OSVCLSA-2026-1773706626 No score

TuxCare security update for got (1 CVE)

TuxCare rebuilt got to address 1 CVE. Fixed in 2.9.2-tuxcare.1.

Record: CLSA-2026-1773706626
Updated: 2026-11-02

OSVCLSA-2026-1784596291 No score

TuxCare security update for got (1 CVE)

TuxCare rebuilt got to address 1 CVE. Fixed in 6.7.1-tuxcare.1.

Record: CLSA-2026-1784596291
Updated: 2026-11-02

OSVCLSA-2026-1790876846 No score

TuxCare security update for got (1 CVE)

TuxCare rebuilt got to address 1 CVE. Fixed in 7.1.0-tuxcare.1.

Record: CLSA-2026-1790876846
Updated: 2026-11-02

OSVCLSA-2026-1792701218 No score

TuxCare security update for got (1 CVE)

TuxCare rebuilt got to address 1 CVE. Fixed in 10.7.0-tuxcare.1.

Record: CLSA-2026-1792701218
Updated: 2026-11-02

OSV No score

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Record: CVE-2022-33987
Updated: 2026-11-02

Affected products

got project got

Affected packages

Affected packages
Package	Affected	Fixed
`got` npm	12.0.0 up to 12.1.0	12.1.0
`got` npm	before 11.8.5	11.8.5
`nodejs` AlmaLinux:8 From an advisory covering 5 CVEs	before 1:14.20.0-2.module_el8.6.0+3261+490666b3	1:14.20.0-2.module_el8.6.0+3261+490666b3
`nodejs-devel` AlmaLinux:8 From an advisory covering 5 CVEs	before 1:14.20.0-2.module_el8.6.0+3261+490666b3	1:14.20.0-2.module_el8.6.0+3261+490666b3
`nodejs-docs` AlmaLinux:8 From an advisory covering 5 CVEs	before 1:14.20.0-2.module_el8.6.0+3261+490666b3	1:14.20.0-2.module_el8.6.0+3261+490666b3
`nodejs-full-i18n` AlmaLinux:8 From an advisory covering 5 CVEs	before 1:14.20.0-2.module_el8.6.0+3261+490666b3	1:14.20.0-2.module_el8.6.0+3261+490666b3
`nodejs-nodemon` AlmaLinux:8 From an advisory covering 5 CVEs	before 2.0.19-2.module_el8.6.0+3261+490666b3	2.0.19-2.module_el8.6.0+3261+490666b3
`nodejs-packaging` AlmaLinux:8 From an advisory covering 5 CVEs	before 23-3.module_el8.5.0+2618+8d46dafd	23-3.module_el8.5.0+2618+8d46dafd
`npm` AlmaLinux:8 From an advisory covering 5 CVEs	before 1:6.14.17-1.14.20.0.2.module_el8.6.0+3261+490666b3	1:6.14.17-1.14.20.0.2.module_el8.6.0+3261+490666b3
`nodejs` AlmaLinux:9 From an advisory covering 10 CVEs	before 1:16.16.0-1.el9_0	1:16.16.0-1.el9_0

Show 77 moreShow less

Affected packages
Package	Affected	Fixed
`nodejs-docs` AlmaLinux:9 From an advisory covering 10 CVEs	before 1:16.16.0-1.el9_0	1:16.16.0-1.el9_0
`nodejs-full-i18n` AlmaLinux:9 From an advisory covering 10 CVEs	before 1:16.16.0-1.el9_0	1:16.16.0-1.el9_0
`nodejs-libs` AlmaLinux:9 From an advisory covering 10 CVEs	before 1:16.16.0-1.el9_0	1:16.16.0-1.el9_0
`nodejs-nodemon` AlmaLinux:9 From an advisory covering 10 CVEs	before 2.0.19-1.el9_0	2.0.19-1.el9_0
`npm` AlmaLinux:9 From an advisory covering 10 CVEs	before 1:8.11.0-1.16.16.0.1.el9_0	1:8.11.0-1.16.16.0.1.el9_0
`got` TuxCare:npm	8.3.2-tuxcare.0 up to 8.3.2-tuxcare.1, plus listed versions 8.3.2	8.3.2-tuxcare.1
`got` TuxCare:npm	9.6.0-tuxcare.0 up to 9.6.0-tuxcare.1, plus listed versions 9.6.0	9.6.0-tuxcare.1
`got` TuxCare:npm	2.9.2-tuxcare.0 up to 2.9.2-tuxcare.1, plus listed versions 2.9.2	2.9.2-tuxcare.1
`got` TuxCare:npm	6.7.1-tuxcare.0 up to 6.7.1-tuxcare.1, plus listed versions 6.7.1	6.7.1-tuxcare.1
`got` TuxCare:npm	7.1.0-tuxcare.0 up to 7.1.0-tuxcare.1, plus listed versions 7.1.0	7.1.0-tuxcare.1
`got` TuxCare:npm	10.7.0-tuxcare.0 up to 10.7.0-tuxcare.1, plus listed versions 10.7.0	10.7.0-tuxcare.1
`node-got` Debian:12	before 11.8.3+~cs58.7.37-3	11.8.3+~cs58.7.37-3
`node-got` Debian:13	before 11.8.3+~cs58.7.37-3	11.8.3+~cs58.7.37-3
`node-got` Debian:14	before 11.8.3+~cs58.7.37-3	11.8.3+~cs58.7.37-3
`rh-nodejs14-nodejs` Red Hat:rhel_software_collections:3::el7 From an advisory covering 5 CVEs	before 0:14.20.0-2.el7	0:14.20.0-2.el7
`rh-nodejs14-nodejs-debuginfo` Red Hat:rhel_software_collections:3::el7 From an advisory covering 5 CVEs	before 0:14.20.0-2.el7	0:14.20.0-2.el7
`rh-nodejs14-nodejs-devel` Red Hat:rhel_software_collections:3::el7 From an advisory covering 5 CVEs	before 0:14.20.0-2.el7	0:14.20.0-2.el7
`rh-nodejs14-nodejs-docs` Red Hat:rhel_software_collections:3::el7 From an advisory covering 5 CVEs	before 0:14.20.0-2.el7	0:14.20.0-2.el7
`rh-nodejs14-npm` Red Hat:rhel_software_collections:3::el7 From an advisory covering 5 CVEs	before 0:6.14.17-14.20.0.2.el7	0:6.14.17-14.20.0.2.el7
`rh-nodejs14-nodejs-nodemon` Red Hat:rhel_software_collections:3::el7 From an advisory covering 5 CVEs	before 0:2.0.19-1.el7	0:2.0.19-1.el7
`nodejs` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9	1:14.20.0-2.module+el8.6.0+16231+7c1b33d9
`nodejs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9	1:14.20.0-2.module+el8.6.0+16231+7c1b33d9
`nodejs-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9	1:14.20.0-2.module+el8.6.0+16231+7c1b33d9
`nodejs-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9	1:14.20.0-2.module+el8.6.0+16231+7c1b33d9
`nodejs-docs` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9	1:14.20.0-2.module+el8.6.0+16231+7c1b33d9
`nodejs-full-i18n` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9	1:14.20.0-2.module+el8.6.0+16231+7c1b33d9
`nodejs-nodemon` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:2.0.19-2.module+el8.6.0+16231+7c1b33d9	0:2.0.19-2.module+el8.6.0+16231+7c1b33d9
`nodejs-packaging` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 0:23-3.module+el8.3.0+6519+9f98ed83	0:23-3.module+el8.3.0+6519+9f98ed83
`npm` Red Hat:enterprise_linux:8::appstream From an advisory covering 5 CVEs	before 1:6.14.17-1.14.20.0.2.module+el8.6.0+16231+7c1b33d9	1:6.14.17-1.14.20.0.2.module+el8.6.0+16231+7c1b33d9
`nodejs` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 1:16.16.0-3.module+el8.6.0+16248+76b0e185	1:16.16.0-3.module+el8.6.0+16248+76b0e185
`nodejs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 1:16.16.0-3.module+el8.6.0+16248+76b0e185	1:16.16.0-3.module+el8.6.0+16248+76b0e185
`nodejs-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 1:16.16.0-3.module+el8.6.0+16248+76b0e185	1:16.16.0-3.module+el8.6.0+16248+76b0e185
`nodejs-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 1:16.16.0-3.module+el8.6.0+16248+76b0e185	1:16.16.0-3.module+el8.6.0+16248+76b0e185
`nodejs-docs` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 1:16.16.0-3.module+el8.6.0+16248+76b0e185	1:16.16.0-3.module+el8.6.0+16248+76b0e185
`nodejs-full-i18n` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 1:16.16.0-3.module+el8.6.0+16248+76b0e185	1:16.16.0-3.module+el8.6.0+16248+76b0e185
`nodejs-nodemon` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 0:2.0.19-2.module+el8.6.0+16240+7ca51420	0:2.0.19-2.module+el8.6.0+16240+7ca51420
`nodejs-packaging` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 0:25-1.module+el8.5.0+10992+fac5fe06	0:25-1.module+el8.5.0+10992+fac5fe06
`npm` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 1:8.11.0-1.16.16.0.3.module+el8.6.0+16248+76b0e185	1:8.11.0-1.16.16.0.3.module+el8.6.0+16248+76b0e185
`nodejs-nodemon` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 0:2.0.19-1.el9_0	0:2.0.19-1.el9_0
`nodejs` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 1:16.16.0-1.el9_0	1:16.16.0-1.el9_0
`nodejs-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 1:16.16.0-1.el9_0	1:16.16.0-1.el9_0
`nodejs-debugsource` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 1:16.16.0-1.el9_0	1:16.16.0-1.el9_0
`nodejs-docs` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 1:16.16.0-1.el9_0	1:16.16.0-1.el9_0
`nodejs-full-i18n` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 1:16.16.0-1.el9_0	1:16.16.0-1.el9_0
`nodejs-libs` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 1:16.16.0-1.el9_0	1:16.16.0-1.el9_0
`nodejs-libs-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 1:16.16.0-1.el9_0	1:16.16.0-1.el9_0
`npm` Red Hat:enterprise_linux:9::appstream From an advisory covering 10 CVEs	before 1:8.11.0-1.16.16.0.1.el9_0	1:8.11.0-1.16.16.0.1.el9_0
`nodejs` Red Hat:rhel_eus:8.4::appstream From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.4.0+16234+70f4adc8	1:14.20.0-2.module+el8.4.0+16234+70f4adc8
`nodejs-debuginfo` Red Hat:rhel_eus:8.4::appstream From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.4.0+16234+70f4adc8	1:14.20.0-2.module+el8.4.0+16234+70f4adc8
`nodejs-debugsource` Red Hat:rhel_eus:8.4::appstream From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.4.0+16234+70f4adc8	1:14.20.0-2.module+el8.4.0+16234+70f4adc8
`nodejs-devel` Red Hat:rhel_eus:8.4::appstream From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.4.0+16234+70f4adc8	1:14.20.0-2.module+el8.4.0+16234+70f4adc8
`nodejs-docs` Red Hat:rhel_eus:8.4::appstream From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.4.0+16234+70f4adc8	1:14.20.0-2.module+el8.4.0+16234+70f4adc8
`nodejs-full-i18n` Red Hat:rhel_eus:8.4::appstream From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.4.0+16234+70f4adc8	1:14.20.0-2.module+el8.4.0+16234+70f4adc8
`nodejs-nodemon` Red Hat:rhel_eus:8.4::appstream From an advisory covering 5 CVEs	before 0:2.0.19-2.module+el8.4.0+16234+70f4adc8	0:2.0.19-2.module+el8.4.0+16234+70f4adc8
`nodejs-packaging` Red Hat:rhel_eus:8.4::appstream From an advisory covering 5 CVEs	before 0:23-3.module+el8.3.0+6519+9f98ed83	0:23-3.module+el8.3.0+6519+9f98ed83
`npm` Red Hat:rhel_eus:8.4::appstream From an advisory covering 5 CVEs	before 1:6.14.17-1.14.20.0.2.module+el8.4.0+16234+70f4adc8	1:6.14.17-1.14.20.0.2.module+el8.4.0+16234+70f4adc8
`nodejs` Rocky Linux:8 From an advisory covering 5 CVEs	before 1:14.20.0-2.module+el8.6.0+1004+df064614	1:14.20.0-2.module+el8.6.0+1004+df064614
`nodejs-nodemon` Rocky Linux:8 From an advisory covering 5 CVEs	before 0:2.0.19-2.module+el8.6.0+1046+80feca58	0:2.0.19-2.module+el8.6.0+1046+80feca58
`nodejs-nodemon` Rocky Linux:8 From an advisory covering 5 CVEs	before 0:2.0.19-2.module+el8.6.0+1003+ae94235a	0:2.0.19-2.module+el8.6.0+1003+ae94235a
`nodejs-packaging` Rocky Linux:8 From an advisory covering 5 CVEs	before 0:23-3.module+el8.7.0+1071+4bdda2a8	0:23-3.module+el8.7.0+1071+4bdda2a8
`nodejs-packaging` Rocky Linux:8 From an advisory covering 5 CVEs	before 0:23-3.module+el8.3.0+100+234774f7	0:23-3.module+el8.3.0+100+234774f7
`nodejs-packaging` Rocky Linux:8 From an advisory covering 5 CVEs	before 0:23-3.module+el8.5.0+733+de4fee6c	0:23-3.module+el8.5.0+733+de4fee6c
`nodejs` Rocky Linux:8 From an advisory covering 6 CVEs	before 1:16.16.0-3.module+el8.6.0+1003+ae94235a	1:16.16.0-3.module+el8.6.0+1003+ae94235a
`nodejs-nodemon` Rocky Linux:8 From an advisory covering 6 CVEs	before 0:2.0.19-2.module+el8.6.0+1046+80feca58	0:2.0.19-2.module+el8.6.0+1046+80feca58
`nodejs-nodemon` Rocky Linux:8 From an advisory covering 6 CVEs	before 0:2.0.19-2.module+el8.6.0+1003+ae94235a	0:2.0.19-2.module+el8.6.0+1003+ae94235a
`nodejs-packaging` Rocky Linux:8 From an advisory covering 6 CVEs	before 0:25-1.module+el8.6.0+1046+80feca58	0:25-1.module+el8.6.0+1046+80feca58
`nodejs-packaging` Rocky Linux:8 From an advisory covering 6 CVEs	before 0:25-1.module+el8.5.0+702+221f14e6	0:25-1.module+el8.5.0+702+221f14e6
`nodejs-nodemon` Rocky Linux:9 From an advisory covering 10 CVEs	before 0:2.0.19-1.el9_0	0:2.0.19-1.el9_0
`@rootio/got` Root:npm	before 8.3.2-root.io.1	8.3.2-root.io.18.3.2-root.io.26.7.1-root.io.17.1.0-root.io.1
`got` Root:npm	before 8.3.2-aikido.2	8.3.2-aikido.26.7.1-aikido.17.1.0-aikido.1
`node-got` Ubuntu:18.04:LTS	All versions, plus listed versions 7.1.0-1	None known
`node-got` Ubuntu:20.04:LTS	All versions, plus listed versions 7.1.0-1	None known
`node-got` Ubuntu:22.04:LTS	All versions, plus listed versions 11.8.1+~cs53.13.17-311.8.2+~cs58.7.32-211.8.3+~cs58.7.37-1	None known
`node-got` Ubuntu:24.04:LTS	All versions, plus listed versions 11.8.5+~cs58.13.36-3	None known
`node-got` Ubuntu:25.10	All versions, plus listed versions 11.8.5+~cs58.13.36-5	None known
`node-got` Ubuntu:26.10	All versions, plus listed versions 11.8.5+~cs58.13.36-611.8.5+~cs58.13.36-7	None known
`node-got` Ubuntu:26.04:LTS	All versions, plus listed versions 11.8.5+~cs58.13.36-511.8.5+~cs58.13.36-6	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-33987 is a medium vulnerability (CVSS 5.3) in Got Project Got, published June 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.42%, the 84th percentile. Fixed in got 12.1.0.

References

Show 81 moreShow less