Every CVE Search/ Get API key

CVE-2018-12120

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by...

8.1 HighFix available

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as node --debug=localhost. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.28%Up 3.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as node --debug=localhost. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Record
CVE-2018-12120
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-419, CWE-829
Updated
2026-11-02
CVE List No score

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as node --debug=localhost. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Record
CVE-2018-12120
Weakness
CWE-419
Updated
2026-11-02
EUVDEUVD-2018-4098 No score

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as node --debug=localhost. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Record
EUVD-2018-4098
Updated
2026-11-02
GitHub AdvisoriesGHSA-8fqw-43x4-4q75 8.1

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by...

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as node --debug=localhost. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Record
GHSA-8fqw-43x4-4q75
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-419, CWE-829
Updated
2026-11-02
OSV 8.1

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as node --debug=localhost. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Record
CVE-2018-12120
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-12120 8.1

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as node --debug=localhost. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Record
DEBIAN-CVE-2018-12120
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2018-12120 8.1

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as node --debug=localhost. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Record
UBUNTU-CVE-2018-12120
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2019-0277 No score

Updated nodejs packages fix security vulnerabilities

This update provides nodejs v6.17.1 fixing at least the following security issues:

The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer (CVE-2017-1000381)

Fix for 'path' module regular expression denial of service (CVE-2018-7158)

Reject spaces in HTTP Content-Length header values (CVE-2018-7159)

Fix for inspector DNS rebinding vulnerability (CVE-2018-7160)

buffer: Fixes Denial of Service vulnerability where calling Buffer.fill() could hang (CVE-2018-7167)

buffer: Fix out-of-bounds (OOB) write in Buffer.write() for UCS-2 encoding (CVE-2018-12115)

Node.js: HTTP request splitting (CVE-2018-12116)

Node.js: Debugger port 5858 listens on any interface by default (CVE-2018-12120)

Node.js: Denial of Service with large HTTP headers (CVE-2018-12121)

Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122)

Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123)

Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)

Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)

For other fixes in this update, see the referenced release logs.

Record
MGASA-2019-0277
Updated
2026-11-02
OSVSUSE-SU-2019:0117-1 No score

Security update for nodejs4

This update for nodejs4 fixes the following issues:

Security issues fixed:

  • CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation (bsc#1113652)
  • CVE-2018-5407: Fixed a hyperthread port content side channel attack (aka 'PortSmash') (bsc#1113534)
  • CVE-2018-12120: Fixed that the debugger listens on any interface by default (bsc#1117625)
  • CVE-2018-12121: Fixed a denial of Service with large HTTP headers (bsc#1117626)
  • CVE-2018-12122: Fixed the 'Slowloris' HTTP Denial of Service (bsc#1117627)
  • CVE-2018-12116: Fixed HTTP request splitting (bsc#1117630)
  • CVE-2018-12123: Fixed hostname spoofing in URL parser for javascript protocol (bsc#1117629)
Record
SUSE-SU-2019:0117-1
Updated
2026-11-02
OSVSUSE-SU-2019:0395-1 No score

Security update for nodejs6

This update for nodejs6 to version 6.16.0 fixes the following issues:

Security issues fixed:

  • CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation (bsc#1113652)
  • CVE-2018-5407: Fixed a hyperthread port content side channel attack (aka 'PortSmash') (bsc#1113534)
  • CVE-2018-12120: Fixed that the debugger listens on any interface by default (bsc#1117625)
  • CVE-2018-12121: Fixed a denial of Service with large HTTP headers (bsc#1117626)
  • CVE-2018-12122: Fixed the 'Slowloris' HTTP Denial of Service (bsc#1117627)
  • CVE-2018-12116: Fixed HTTP request splitting (bsc#1117630)
  • CVE-2018-12123: Fixed hostname spoofing in URL parser for javascript protocol (bsc#1117629)
Record
SUSE-SU-2019:0395-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
Debian:12
 before 8.9.3~dfsg-5
8.9.3~dfsg-5
nodejs
Debian:13
 before 8.9.3~dfsg-5
8.9.3~dfsg-5
nodejs
Debian:14
 before 8.9.3~dfsg-5
8.9.3~dfsg-5
nodejs
Mageia:6
From an advisory covering 13 CVEs
 before 6.17.1-8.mga6
6.17.1-8.mga6
http-parser
Mageia:6
From an advisory covering 13 CVEs
 before 2.9.2-1.mga6
2.9.2-1.mga6
libuv
Mageia:6
From an advisory covering 13 CVEs
 before 1.16.1-1.mga6
1.16.1-1.mga6
nodejs4
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 7 CVEs
 before 4.9.1-15.17.1
4.9.1-15.17.1
nodejs4
SUSE:Enterprise Storage 4
From an advisory covering 7 CVEs
 before 4.9.1-15.17.1
4.9.1-15.17.1
nodejs6
SUSE:OpenStack Cloud 7
From an advisory covering 7 CVEs
 before 6.16.0-11.21.1
6.16.0-11.21.1
nodejs6
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 7 CVEs
 before 6.16.0-11.21.1
6.16.0-11.21.1
nodejs6
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 7 CVEs
 before 6.16.0-11.21.1
6.16.0-11.21.1
nodejs6
SUSE:Enterprise Storage 4
From an advisory covering 7 CVEs
 before 6.16.0-11.21.1
6.16.0-11.21.1

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-12120 is a high vulnerability (CVSS 8.1) in Node.js, published November 28, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.28%, the 91st percentile. Fixed in nodejs 8.9.3~dfsg-5.

References

Show 39 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open