{"id":"CVE-2022-36127","aliases":["EUVD-2022-6291","GHSA-8gpg-466c-5cpj"],"status":"published","title":"Service unavailability impact in NodeJS agent(version \u003c= 0.5.0)","description":"A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01866,"percentile":0.79479,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-07-18T11:30:13Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"npm","package":"skywalking-backend-js","fixed_in":["0.5.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"skywalking-backend-js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.1"}]}]},{"source":"osv","ecosystem":"npm","package":"skywalking-backend-js","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.1"}]}]}],"products":[{"vendor":"apache","product":"skywalking_nodejs_agent"},{"vendor":"apache software foundation","product":"apache skywalking nodejs agent"}],"references":[{"url":"https://lists.apache.org/thread/x238wo4r5goy39dxdjcmlofp6gcdnqr3","tags":["x_refsource_MISC","x_transferred","Mailing List","Release Notes","Vendor Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/07/18/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36127","tags":["advisory"]},{"url":"https://skywalking.apache.org/events/release-apache-skywalking-nodejs-0-5-1/"},{"url":"https://github.com/advisories/GHSA-8gpg-466c-5cpj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36127.json","tags":["advisory"]},{"url":"https://github.com/apache/skywalking-nodejs","tags":["package"]},{"url":"https://skywalking.apache.org/events/release-apache-skywalking-nodejs-0-5-1","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-36127","title":"Service unavailability impact in NodeJS agent(version \u003c= 0.5.0)","description":"A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.","status":"published","published":"2022-07-18T11:30:13Z","modified":"2024-08-03T10:00:01.456Z","updated_at":"2026-11-02T14:34:35.615708Z"}],"euvd":[{"id":"EUVD-2022-6291","description":"A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.","status":"published","published":"2022-07-18T11:30:13Z","modified":"2024-08-03T10:00:01Z","updated_at":"2026-11-03T03:25:26.362132Z"}],"ghsa":[{"id":"GHSA-8gpg-466c-5cpj","title":"Apache SkyWalking NodeJS Agent can lose availability if header includes illegal SkyWalking header","description":"A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.","status":"published","published":"2022-07-19T00:00:27Z","modified":"2023-01-27T05:06:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:36:21.8171Z"}],"nvd":[{"id":"CVE-2022-36127","description":"A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.","status":"published","published":"2022-07-18T12:15:08.15Z","modified":"2026-06-17T04:52:58.567Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:07:23.686531Z"}],"osv":[{"id":"GHSA-8gpg-466c-5cpj","title":"Apache SkyWalking NodeJS Agent can lose availability if header includes illegal SkyWalking header","description":"A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.","status":"published","published":"2022-07-19T00:00:27Z","modified":"2023-11-08T04:10:01.963006Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"CVE-2022-36127","title":"Service unavailability impact in NodeJS agent(version \u003c= 0.5.0)","description":"A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.","status":"published","published":"2022-07-18T11:30:13Z","modified":"2026-10-28T02:31:14.988782986Z","updated_at":"2026-11-02T15:44:26.195407Z"}]}}