{"id":"CVE-2022-32223","aliases":["ALPINE-CVE-2022-32223","BIT-node-2022-32223","BIT-node-min-2022-32223","EUVD-2022-53424","GHSA-fxjx-rf8x-pxw8","UBUNTU-CVE-2022-32223"],"status":"published","title":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows...","description":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01752,"percentile":0.78062,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-427"],"published":"2022-07-14T14:51:18Z","modified":"2026-10-28T02:30:24Z","exploits":[{"source":"pocgithub","id":"ianyong/cve-2022-32223","title":"ianyong/cve-2022-32223","date":"2022-10-12","url":"https://github.com/ianyong/cve-2022-32223"}],"fixes":[{"ecosystem":"Bitnami","package":"node","fixed_in":["14.14.1","14.20.0","16.12.1","16.16.0","18.0.5"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["14.14.1","14.20.0","16.12.1","16.16.0","18.0.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.14.1"},{"introduced":"14.14.0"},{"fixed":"14.20.0"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.16.0"},{"introduced":"18.0.0"},{"fixed":"18.0.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.14.1"},{"introduced":"14.14.0"},{"fixed":"14.20.0"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.16.0"},{"introduced":"18.0.0"},{"fixed":"18.0.5"}]}]}],"products":[{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory","article"]},{"url":"https://hackerone.com/reports/1447455","tags":["x_refsource_MISC","x_transferred","Permissions Required","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32223","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fxjx-rf8x-pxw8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-32223","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32223.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-32223","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#dll-hijacking-on-windows-high-cve-2022-32223","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32223","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-32223","description":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.","status":"published","published":"2022-07-14T14:51:18Z","modified":"2025-04-30T22:24:45.953Z","cwes":["CWE-427"],"updated_at":"2026-11-02T14:34:36.578327Z"}],"euvd":[{"id":"EUVD-2022-53424","description":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.","status":"published","published":"2022-07-14T14:51:18Z","modified":"2025-04-30T22:24:45Z","updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-fxjx-rf8x-pxw8","title":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows...","description":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.","status":"published","published":"2022-07-15T00:00:19Z","modified":"2023-02-02T05:07:16Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:52:28.437617Z"}],"nvd":[{"id":"CVE-2022-32223","description":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.","status":"published","published":"2022-07-14T15:15:08.487Z","modified":"2026-06-17T04:46:54.723Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:07:23.686531Z"}],"osv":[{"id":"ALPINE-CVE-2022-32223","description":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.","status":"withdrawn","published":"2022-07-14T15:15:08.487Z","modified":"2026-07-14T08:03:30.786044851Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.202584Z"},{"id":"UBUNTU-CVE-2022-32223","description":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.","status":"withdrawn","published":"2022-07-14T15:15:00Z","modified":"2025-07-16T07:44:38.009086Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"BIT-node-2022-32223","description":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.","status":"published","published":"2024-03-06T11:03:27.6Z","modified":"2026-09-08T08:48:17.681009721Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2022-32223","description":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.","status":"published","published":"2024-12-16T14:01:55.327Z","modified":"2026-09-08T08:48:17.432770312Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CVE-2022-32223","description":"Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.","status":"published","published":"2022-07-14T14:51:18Z","modified":"2026-10-28T02:30:24.1347959Z","cwes":["CWE-427"],"updated_at":"2026-11-02T15:44:25.860945Z"}]}}