{"id":"CVE-2022-33987","aliases":["ALSA-2022:6448","ALSA-2022:6595","CLSA-2026-1771891819","CLSA-2026-1773188113","CLSA-2026-1773706626","CLSA-2026-1784596291","CLSA-2026-1790876846","CLSA-2026-1792701218","DEBIAN-CVE-2022-33987","EUVD-2022-6110","GHSA-pfrx-2q88-qq97","RHSA-2022:6389","RHSA-2022:6448","RHSA-2022:6449","RHSA-2022:6595","RHSA-2022:6985","RLSA-2022:6448","RLSA-2022:6449","RLSA-2022:6595","ROOT-APP-NPM-CVE-2022-33987","UBUNTU-CVE-2022-33987"],"status":"published","title":"Got allows a redirect to a UNIX socket","description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02416,"percentile":0.84259,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-06-18T20:51:12Z","modified":"2026-11-03T08:04:08Z","fixes":[{"ecosystem":"npm","package":"got","fixed_in":["12.1.0","11.8.5"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"got","fixed_in":["8.3.2-tuxcare.1","9.6.0-tuxcare.1","2.9.2-tuxcare.1","6.7.1-tuxcare.1","7.1.0-tuxcare.1","10.7.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-got","fixed_in":["11.8.3+~cs58.7.37-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-got","fixed_in":["11.8.3+~cs58.7.37-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-got","fixed_in":["11.8.3+~cs58.7.37-3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/got","fixed_in":["8.3.2-root.io.1","8.3.2-root.io.2","6.7.1-root.io.1","7.1.0-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"got","fixed_in":["8.3.2-aikido.2","6.7.1-aikido.1","7.1.0-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.1.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.8.5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module_el8.6.0+3261+490666b3"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module_el8.6.0+3261+490666b3"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module_el8.6.0+3261+490666b3"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module_el8.6.0+3261+490666b3"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.19-2.module_el8.6.0+3261+490666b3"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.5.0+2618+8d46dafd"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.17-1.14.20.0.2.module_el8.6.0+3261+490666b3"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.19-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.11.0-1.16.16.0.1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.2-tuxcare.0"},{"fixed":"8.3.2-tuxcare.1"}]}],"versions":["8.3.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.6.0-tuxcare.0"},{"fixed":"9.6.0-tuxcare.1"}]}],"versions":["9.6.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.2-tuxcare.0"},{"fixed":"2.9.2-tuxcare.1"}]}],"versions":["2.9.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.7.1-tuxcare.0"},{"fixed":"6.7.1-tuxcare.1"}]}],"versions":["6.7.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0-tuxcare.0"},{"fixed":"7.1.0-tuxcare.1"}]}],"versions":["7.1.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.7.0-tuxcare.0"},{"fixed":"10.7.0-tuxcare.1"}]}],"versions":["10.7.0"]},{"source":"osv","ecosystem":"Debian:12","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.8.3+~cs58.7.37-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.8.3+~cs58.7.37-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.8.3+~cs58.7.37-3"}]}]},{"source":"osv","ecosystem":"npm","package":"got","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.1.0"}]}]},{"source":"osv","ecosystem":"npm","package":"got","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"11.8.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.20.0-2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.20.0-2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.20.0-2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.20.0-2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.17-14.20.0.2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.6.0+16231+7c1b33d9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.6.0+16231+7c1b33d9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.6.0+16231+7c1b33d9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.6.0+16231+7c1b33d9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.6.0+16231+7c1b33d9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.6.0+16231+7c1b33d9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.module+el8.6.0+16231+7c1b33d9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.17-1.14.20.0.2.module+el8.6.0+16231+7c1b33d9"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-3.module+el8.6.0+16248+76b0e185"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-3.module+el8.6.0+16248+76b0e185"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-3.module+el8.6.0+16248+76b0e185"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-3.module+el8.6.0+16248+76b0e185"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-3.module+el8.6.0+16248+76b0e185"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-3.module+el8.6.0+16248+76b0e185"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.module+el8.6.0+16240+7ca51420"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.5.0+10992+fac5fe06"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.11.0-1.16.16.0.3.module+el8.6.0+16248+76b0e185"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.11.0-1.16.16.0.1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.4.0+16234+70f4adc8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.4.0+16234+70f4adc8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.4.0+16234+70f4adc8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.4.0+16234+70f4adc8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.4.0+16234+70f4adc8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.4.0+16234+70f4adc8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.module+el8.4.0+16234+70f4adc8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.17-1.14.20.0.2.module+el8.4.0+16234+70f4adc8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.20.0-2.module+el8.6.0+1004+df064614"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.module+el8.6.0+1046+80feca58"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.module+el8.6.0+1003+ae94235a"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.16.0-3.module+el8.6.0+1003+ae94235a"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.module+el8.6.0+1046+80feca58"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-2.module+el8.6.0+1003+ae94235a"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.6.0+1046+80feca58"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.5.0+702+221f14e6"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.19-1.el9_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.2-root.io.1"},{"fixed":"8.3.2-root.io.2"},{"fixed":"6.7.1-root.io.1"},{"fixed":"7.1.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.2-aikido.2"},{"fixed":"6.7.1-aikido.1"},{"fixed":"7.1.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.8.1+~cs53.13.17-3","11.8.2+~cs58.7.32-2","11.8.3+~cs58.7.37-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.8.5+~cs58.13.36-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.8.5+~cs58.13.36-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.8.5+~cs58.13.36-6","11.8.5+~cs58.13.36-7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-got","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.8.5+~cs58.13.36-5","11.8.5+~cs58.13.36-6"]}],"products":[{"vendor":"got_project","product":"got"}],"references":[{"url":"https://github.com/sindresorhus/got/pull/2047","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","article","report"]},{"url":"https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web","report"]},{"url":"https://github.com/sindresorhus/got/releases/tag/v11.8.5","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-33987","tags":["advisory"]},{"url":"https://github.com/sindresorhus/got/commit/861ccd9ac2237df762a9e2beed7edd88c60782dc","tags":["web"]},{"url":"https://github.com/sindresorhus/got/releases/tag/v12.1.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pfrx-2q88-qq97"},{"url":"https://access.redhat.com/errata/RHSA-2022:6448","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32212","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32213","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32214","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32215","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-33987","tags":["report"]},{"url":"https://bugzilla.redhat.com/2102001","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105422","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105426","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105428","tags":["report"]},{"url":"https://bugzilla.redhat.com/2105430","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-6448.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6595","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28469","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33502","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3807","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-29244","tags":["report"]},{"url":"https://bugzilla.redhat.com/1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/1964461","tags":["report"]},{"url":"https://bugzilla.redhat.com/2007557","tags":["report"]},{"url":"https://bugzilla.redhat.com/2098556","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-6595.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/33xxx/CVE-2022-33987.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-33987","tags":["advisory"]},{"url":"https://github.com/sindresorhus/got","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6389","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2102001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106673","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6389.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32212","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32213","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32214","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32215","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-33987","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106367","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6448.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6449","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2007557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106369","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6449.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3807","tags":["advisory"]},{"url":"https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2098556","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124299","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6595.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28469","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33502","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29244","tags":["advisory"]},{"url":"https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6985","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106368","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6985.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:6448","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:6449","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:6595","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-33987","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-33987","description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","status":"published","published":"2022-06-18T20:51:12Z","modified":"2024-08-03T08:16:16.308Z","updated_at":"2026-11-02T14:34:40.275153Z"}],"euvd":[{"id":"EUVD-2022-6110","description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","status":"published","published":"2022-06-18T20:51:12Z","modified":"2024-08-03T08:16:16Z","updated_at":"2026-11-03T03:25:29.68115Z"}],"ghsa":[{"id":"GHSA-pfrx-2q88-qq97","title":"Got allows a redirect to a UNIX socket","description":"The got package before 11.8.5 and 12.1.0 for Node.js allows a redirect to a UNIX socket.","status":"published","published":"2022-06-19T00:00:21Z","modified":"2023-01-27T05:05:01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T14:36:20.985872Z"}],"nvd":[{"id":"CVE-2022-33987","description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","status":"published","published":"2022-06-18T21:15:07.933Z","modified":"2026-06-17T04:49:37.407Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:22.613788Z"}],"osv":[{"id":"DEBIAN-CVE-2022-33987","description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","status":"published","published":"2022-06-18T21:15:07.933Z","modified":"2026-11-03T08:04:08.452210351Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"GHSA-pfrx-2q88-qq97","title":"Got allows a redirect to a UNIX socket","description":"The got package before 11.8.5 and 12.1.0 for Node.js allows a redirect to a UNIX socket.","status":"published","published":"2022-06-19T00:00:21Z","modified":"2026-09-10T03:49:55.225771209Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"RHSA-2022:6389","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security and bug fix update","status":"published","published":"2024-09-13T21:01:13Z","modified":"2026-10-13T10:03:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6448","title":"Red Hat Security Advisory: nodejs:14 security and bug fix update","status":"published","published":"2024-10-22T00:30:21Z","modified":"2026-10-13T10:03:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6449","title":"Red Hat Security Advisory: nodejs:16 security and bug fix update","status":"published","published":"2024-10-22T00:30:29Z","modified":"2026-10-14T10:02:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:6595","title":"Red Hat Security Advisory: nodejs and nodejs-nodemon security and bug fix update","status":"published","published":"2024-09-16T08:50:27Z","modified":"2026-10-14T10:02:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:6985","title":"Red Hat Security Advisory: nodejs:14 security and bug fix update","status":"published","published":"2024-10-22T00:30:02Z","modified":"2026-10-13T10:03:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RLSA-2022:6448","title":"Moderate: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)\n\n* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)\n\n* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)\n\n* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)\n\n* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:14/nodejs: rebase to latest upstream release (BZ#2106367)\n\n* nodejs:14/nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2111417)","status":"published","published":"2022-09-13T07:36:51Z","modified":"2026-02-04T22:45:09.547892Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:6449","title":"Moderate: nodejs:16 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)\n\n* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)\n\n* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)\n\n* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)\n\n* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: rebase to latest upstream release (BZ#2106369)\n\n* nodejs:16/nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2111416)","status":"published","published":"2022-09-13T07:36:52Z","modified":"2026-02-05T04:00:09.766869Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:6595","title":"Moderate: nodejs and nodejs-nodemon security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)\n\nSecurity Fix(es):\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n\n* nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)\n\n* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)\n\n* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)\n\n* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)\n\n* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)\n\n* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [Rocky Linux-9] (BZ#2121019)\n\n* nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)","status":"published","published":"2022-09-20T11:37:49Z","modified":"2026-02-04T16:15:13.375601Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"ROOT-APP-NPM-CVE-2022-33987","title":"CVE-2022-33987 in @rootio/got - Patched by Root","description":"Root has patched CVE-2022-33987 in the @rootio/got package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-01T09:13:02Z","modified":"2026-07-01T12:34:26.212502899Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"UBUNTU-CVE-2022-33987","description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","status":"published","published":"2022-06-18T21:15:00Z","modified":"2026-10-17T12:56:02.764285317Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"ALSA-2022:6448","title":"Moderate: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)\n* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)\n* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)\n* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)\n* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:14/nodejs: rebase to latest upstream release (BZ#2106367)\n* nodejs:14/nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2111417)","status":"published","published":"2022-09-13T00:00:00Z","modified":"2026-10-29T11:01:19.02919071Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:6595","title":"Moderate: nodejs and nodejs-nodemon security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)\n\nSecurity Fix(es):\n\n* nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)\n* nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)\n* nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)\n* normalize-url: ReDoS for data URLs (CVE-2021-33502)\n* nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)\n* nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)\n* nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)\n* nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)\n* nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)\n* got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [almalinux-9] (BZ#2121019)\n* nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)","status":"published","published":"2022-09-20T00:00:00Z","modified":"2026-10-29T11:31:14.804446972Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2026-1771891819","title":"TuxCare security update for got (1 CVE)","description":"TuxCare rebuilt got to address 1 CVE. Fixed in 8.3.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:47:46.367689929Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773188113","title":"TuxCare security update for got (1 CVE)","description":"TuxCare rebuilt got to address 1 CVE. Fixed in 9.6.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:47:28.194549232Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773706626","title":"TuxCare security update for got (1 CVE)","description":"TuxCare rebuilt got to address 1 CVE. Fixed in 2.9.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:46.731874607Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1784596291","title":"TuxCare security update for got (1 CVE)","description":"TuxCare rebuilt got to address 1 CVE. Fixed in 6.7.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:52.605971608Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1790876846","title":"TuxCare security update for got (1 CVE)","description":"TuxCare rebuilt got to address 1 CVE. Fixed in 7.1.0-tuxcare.1.","status":"published","published":"2026-10-01T17:47:26Z","modified":"2026-10-15T09:48:04.345909622Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792701218","title":"TuxCare security update for got (1 CVE)","description":"TuxCare rebuilt got to address 1 CVE. Fixed in 10.7.0-tuxcare.1.","status":"published","published":"2026-10-22T20:33:38Z","modified":"2026-10-23T02:00:23.072108282Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CVE-2022-33987","description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","status":"published","published":"2022-06-18T20:51:12Z","modified":"2026-10-28T02:31:03.486224874Z","updated_at":"2026-11-02T15:44:25.860945Z"}]}}