CVE-2022-36127
Service unavailability impact in NodeJS agent(version <= 0.5.0)
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
- Record
CVE-2022-36127- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
CVE List No score
Service unavailability impact in NodeJS agent(version <= 0.5.0)
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
- Record
CVE-2022-36127- Updated
- 2026-11-02
EUVDEUVD-2022-6291 No score
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
- Record
EUVD-2022-6291- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8gpg-466c-5cpj
Apache SkyWalking NodeJS Agent can lose availability if header includes illegal SkyWalking header
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
- Record
GHSA-8gpg-466c-5cpj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-8gpg-466c-5cpj
Apache SkyWalking NodeJS Agent can lose availability if header includes illegal SkyWalking header
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
- Record
GHSA-8gpg-466c-5cpj- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV No score
Service unavailability impact in NodeJS agent(version <= 0.5.0)
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
- Record
CVE-2022-36127- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
skywalking-backend-jsnpm |
before 0.5.1 | 0.5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-36127 is a high vulnerability (CVSS 7.5) in Apache Skywalking Nodejs Agent, published July 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.87%, the 79th percentile. Fixed in skywalking-backend-js 0.5.1.
References
lists.apache.org/thread/x238wo4r5goy39dxdjcmlofp6gcdnqr3
openwall.com/lists/oss-security/2022/07/18/1
nvd.nist.gov/vuln/detail/CVE-2022-36127
skywalking.apache.org/events/release-apache-skywalking-nodejs-0-5-1
github.com/advisories/GHSA-8gpg-466c-5cpj