{"id":"CVE-2022-43548","aliases":["ALPINE-CVE-2022-43548","ALSA-2022:8832","ALSA-2022:8833","ALSA-2022:9073","ALSA-2023:0050","ALSA-2023:0321","AZL-11577","BELL-CVE-2022-43548","BIT-node-2022-43548","BIT-node-min-2022-43548","DEBIAN-CVE-2022-43548","DLA-3344-1","DSA-5326-1","EUVD-2022-46545","GHSA-r934-m2c7-26gh","MGASA-2022-0422","OESA-2022-2114","RHSA-2022:8832","RHSA-2022:8833","RHSA-2022:9073","RHSA-2023:0050","RHSA-2023:0321","RHSA-2023:0612","RHSA-2023:1533","RHSA-2023:1742","RLSA-2022:8832","RLSA-2022:8833","RLSA-2022:9073","RLSA-2023:0050","RLSA-2023:0321","SUSE-SU-2022:3967-1","SUSE-SU-2022:3968-1","SUSE-SU-2022:3989-1","SUSE-SU-2022:4003-1","SUSE-SU-2022:4084-1","SUSE-SU-2022:4254-1","SUSE-SU-2022:4255-1","SUSE-SU-2022:4301-1","SUSE-SU-2023:0408-1","SUSE-SU-2023:0419-1","UBUNTU-CVE-2022-43548","USN-6491-1","openSUSE-SU-2024:12488-1","openSUSE-SU-2024:12489-1","openSUSE-SU-2024:12554-1"],"status":"published","title":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19...","description":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.14908,"percentile":0.96728,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2022-11-13T02:25:20Z","modified":"2026-11-03T07:18:33Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["18.12.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["18.12.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["18.12.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["18.12.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["18.12.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["18.12.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["18.12.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["18.12.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs","fixed_in":["16.18.1-2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["14.14.1","14.21.1","16.12.1","16.18.1","18.11.1","18.12.1","19.0.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["14.14.1","14.21.1","16.12.1","16.18.1","18.11.1","18.12.1","19.0.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["18.12.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["18.12.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["18.12.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"nodejs","fixed_in":["14.21.1-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs","fixed_in":["12.22.11-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs","fixed_in":["12.22.11-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"nodejs","fixed_in":["12.22.11-3.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","fixed_in":["16.18.1-8.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs14","fixed_in":["14.21.1-6.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","fixed_in":["12.22.12-1.57.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs16","fixed_in":["16.18.1-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"nodejs16","fixed_in":["16.18.1-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs16","fixed_in":["16.18.1-150300.7.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"nodejs16","fixed_in":["16.18.1-150300.7.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs12","fixed_in":["12.22.12-150200.4.41.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs12","fixed_in":["12.22.12-150200.4.41.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs12","fixed_in":["12.22.12-150200.4.41.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs12","fixed_in":["12.22.12-150200.4.41.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs12","fixed_in":["12.22.12-150200.4.41.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs12","fixed_in":["12.22.12-150200.4.41.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs12","fixed_in":["12.22.12-150200.4.41.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs12","fixed_in":["12.22.12-150200.4.41.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"nodejs12","fixed_in":["12.22.12-150200.4.41.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs12","fixed_in":["12.22.12-150200.4.41.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"nodejs12","fixed_in":["12.22.12-150200.4.41.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"nodejs12","fixed_in":["12.22.12-150200.4.41.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs14","fixed_in":["14.21.1-150200.15.40.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs14","fixed_in":["14.21.1-150200.15.40.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs14","fixed_in":["14.21.1-150200.15.40.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs14","fixed_in":["14.21.1-150200.15.40.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs14","fixed_in":["14.21.1-150200.15.40.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs14","fixed_in":["14.21.1-150200.15.40.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs14","fixed_in":["14.21.1-150200.15.40.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs14","fixed_in":["14.21.1-150200.15.40.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"nodejs14","fixed_in":["14.21.1-150200.15.40.2"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs14","fixed_in":["14.21.1-150200.15.40.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"nodejs14","fixed_in":["14.21.1-150200.15.40.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"nodejs14","fixed_in":["14.21.1-150200.15.40.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"nodejs10","fixed_in":["10.24.1-150000.1.53.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","fixed_in":["8.10.0~dfsg-2ubuntu0.4+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"nodejs","fixed_in":["10.19.0~dfsg-3ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nodejs","fixed_in":["12.22.9~dfsg-1ubuntu3.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nodejs18","fixed_in":["18.12.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nodejs19","fixed_in":["19.0.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nodejs-electron","fixed_in":["21.3.2-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.12.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.12.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.12.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.12.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.12.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.12.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.12.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.12.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module_el9.1.0+16+91bc168f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module_el9.1.0+16+91bc168f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module_el9.1.0+16+91bc168f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module_el9.1.0+16+91bc168f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-1.module_el9.1.0+16+91bc168f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.18.12.1.1.module_el9.1.0+16+91bc168f"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module_el8.7.0+3370+40ccb2a8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module_el8.7.0+3370+40ccb2a8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module_el8.7.0+3370+40ccb2a8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module_el8.7.0+3370+40ccb2a8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-1.module_el8.7.0+3370+40ccb2a8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.18.12.1.2.module_el8.7.0+3370+40ccb2a8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module_el8.7.0+3371+ed8c43db"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module_el8.7.0+3371+ed8c43db"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module_el8.7.0+3371+ed8c43db"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module_el8.7.0+3371+ed8c43db"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-2.module_el8.7.0+3371+ed8c43db"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25-1.module_el8.5.0+2605+45d748af"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.16.18.1.3.module_el8.7.0+3371+ed8c43db"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.17-1.14.21.1.2.module_el8.7.0+3373+a4c18c43"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-2.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.16.18.1.3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.18.1-2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.14.1"},{"introduced":"14.15.0"},{"fixed":"14.21.1"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.18.1"},{"introduced":"18.0.0"},{"fixed":"18.11.1"},{"introduced":"18.12.0"},{"fixed":"18.12.1"},{"introduced":"19.0.0"},{"fixed":"19.0.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.14.1"},{"introduced":"14.15.0"},{"fixed":"14.21.1"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.18.1"},{"introduced":"18.0.0"},{"fixed":"18.11.1"},{"introduced":"18.12.0"},{"fixed":"18.12.1"},{"introduced":"19.0.0"},{"fixed":"19.0.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.12.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.12.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.12.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.0~dfsg-1~deb10u3"}]}],"versions":["10.15.2~dfsg-2","10.15.3~dfsg-1","10.16.3~dfsg-1","10.17.0~dfsg-1","10.17.0~dfsg-2","10.19.0~dfsg-1","10.19.0~dfsg-2","10.19.0~dfsg-3","10.19.0~dfsg1-1","10.20.0~dfsg-1","10.20.1~dfsg-1","10.21.0~dfsg-1","10.21.0~dfsg-1~deb10u1","10.23.1~dfsg-1~deb10u1","10.24.0~dfsg-1~deb10u1","10.24.0~dfsg-1~deb10u2"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12~dfsg-1~deb11u3"}]}],"versions":["12.21.0~dfsg-5","12.22.10~dfsg-1","12.22.10~dfsg-2","12.22.12~dfsg-1~deb11u1","12.22.12~dfsg-1~deb11u2","12.22.4~dfsg-1","12.22.5~dfsg-1","12.22.5~dfsg-2","12.22.5~dfsg-2~11u1","12.22.5~dfsg-3","12.22.5~dfsg-4","12.22.5~dfsg-5","12.22.5~dfsg-6","12.22.5~dfsg-7","12.22.7~dfsg-1","12.22.7~dfsg-2","12.22.9~dfsg-1"],"bundled":7},{"source":"osv","ecosystem":"Mageia:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.11-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.11-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.11-3.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.18.12.1.1.module+el9.1.0.z+17326+318294bb"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-1.module+el8.7.0+17282+f47dd33b"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+15582+19c314fa"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+15582+19c314fa"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.18.12.1.2.module+el8.7.0+17306+fc023f99"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.5.0+10992+fac5fe06"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.2-1.16.18.1.3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.1-3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.17-14.21.1.3.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.1-2.module+el8.7.0+1104+549f92a6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-1.module+el8.7.0+1104+549f92a6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+1072+5b168780"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.module+el8.7.0+1108+49363b0d"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+1108+49363b0d"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.6.0+1046+80feca58"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25-1.module+el8.5.0+702+221f14e6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.1-2.module+el8.7.0+1116+bd2a84b4"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.module+el8.7.0+1108+49363b0d"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.18.1-3.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-2.el9_1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.18.1-8.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-6.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-1.57.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.18.1-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.18.1-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.18.1-150300.7.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.18.1-150300.7.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.41.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.41.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.41.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.41.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.41.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.41.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.41.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.41.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.41.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.41.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.41.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.12-150200.4.41.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-150200.15.40.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-150200.15.40.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-150200.15.40.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-150200.15.40.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-150200.15.40.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-150200.15.40.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-150200.15.40.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-150200.15.40.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-150200.15.40.2"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-150200.15.40.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-150200.15.40.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.21.1-150200.15.40.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.53.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.13.0-8.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.13.0-150400.9.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.13.0-150400.9.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.13.0-150400.9.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0~dfsg-2ubuntu0.4+esm4"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0~dfsg-3ubuntu1.3"}]}],"versions":["10.15.2~dfsg-2ubuntu1","10.17.0~dfsg-2ubuntu4","10.17.0~dfsg-2ubuntu6","10.19.0~dfsg-3ubuntu1","10.19.0~dfsg-3ubuntu1.1","10.19.0~dfsg-3ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.9~dfsg-1ubuntu3.2"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.10.0~dfsg-2ubuntu0.4+esm4"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.19.0~dfsg-3ubuntu1.3"}]}],"versions":["10.15.2~dfsg-2ubuntu1","10.17.0~dfsg-2ubuntu4","10.17.0~dfsg-2ubuntu6","10.19.0~dfsg-3ubuntu1","10.19.0~dfsg-3ubuntu1.1","10.19.0~dfsg-3ubuntu1.2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.9~dfsg-1ubuntu3.2"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.12.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.0.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs-electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.3.2-2.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/","tags":["x_transferred","Patch","Vendor Advisory","advisory","article","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230120-0004/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5326","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://security.netapp.com/advisory/ntap-20230427-0007/","tags":["x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43548","tags":["web","advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/november-2022-security-releases"},{"url":"https://security.netapp.com/advisory/ntap-20230120-0004"},{"url":"https://security.netapp.com/advisory/ntap-20230427-0007"},{"url":"https://github.com/advisories/GHSA-r934-m2c7-26gh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-43548","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8832","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3517","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43548","tags":["report"]},{"url":"https://bugzilla.redhat.com/2134609","tags":["report"]},{"url":"https://bugzilla.redhat.com/2140911","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-8832.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8833","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2142818","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-8833.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:9073","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44531","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44532","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44533","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44906","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21824","tags":["report"]},{"url":"https://bugzilla.redhat.com/2040839","tags":["report"]},{"url":"https://bugzilla.redhat.com/2040846","tags":["report"]},{"url":"https://bugzilla.redhat.com/2040856","tags":["report"]},{"url":"https://bugzilla.redhat.com/2040862","tags":["report"]},{"url":"https://bugzilla.redhat.com/2066009","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-9073.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0050","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0235","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24999","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044591","tags":["report"]},{"url":"https://bugzilla.redhat.com/2142821","tags":["report"]},{"url":"https://bugzilla.redhat.com/2150323","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-0050.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0321","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-35256","tags":["report"]},{"url":"https://bugzilla.redhat.com/2130518","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-0321.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-43548","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43548.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-43548","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0422.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31078","tags":["report"]},{"url":"https://github.com/nodejs/node/releases/tag/v14.21.1","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v14.21.0","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v18.12.1/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2114","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140911","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142809","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8832.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3517","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3517","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43548","tags":["advisory","report"]},{"url":"https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548","tags":["article","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142818","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8833.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142806","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_9073.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44531","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44532","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44532","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44533","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44533","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xvch-5gv4-984h","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21824","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044591","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2150323","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0050.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0235","tags":["advisory"]},{"url":"https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24999","tags":["advisory"]},{"url":"https://github.com/expressjs/express/releases/tag/4.17.3","tags":["article"]},{"url":"https://github.com/ljharb/qs/pull/428","tags":["article"]},{"url":"https://github.com/n8tz/CVE-2022-24999","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2130518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142808","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0321.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-35256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35256","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0612","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2009880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156324","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0612.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35065","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35065","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35065","tags":["advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1533","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170644","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2171935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175828","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1533.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4904","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4904","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/issues/496","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25881","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25881","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-38900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-38900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38900","tags":["advisory"]},{"url":"https://github.com/SamVerschueren/decode-uri-component/issues/5","tags":["article"]},{"url":"https://github.com/advisories/GHSA-w573-4hg7-7wgq","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23918","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23920","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23920","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1742","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175827","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1742.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8832","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:8833","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:9073","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0050","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0321","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223967-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205119","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43548","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223968-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223989-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224003-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224084-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224254-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224255-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224301-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230408-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200303","tags":["report"]},{"url":"https://bugzilla.suse.com/1201325","tags":["report"]},{"url":"https://bugzilla.suse.com/1201326","tags":["report"]},{"url":"https://bugzilla.suse.com/1201327","tags":["report"]},{"url":"https://bugzilla.suse.com/1201328","tags":["report"]},{"url":"https://bugzilla.suse.com/1203831","tags":["report"]},{"url":"https://bugzilla.suse.com/1203832","tags":["report"]},{"url":"https://bugzilla.suse.com/1205042","tags":["report"]},{"url":"https://bugzilla.suse.com/1205236","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35256","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230419-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-43548","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6491-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-32212","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32213","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-32215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-35256","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-43548","description":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.","status":"published","published":"2022-12-05T00:00:00Z","modified":"2025-04-30T05:55:04.408Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:25.618175Z"}],"euvd":[{"id":"EUVD-2022-46545","description":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.","status":"published","published":"2022-12-05T00:00:00Z","modified":"2025-04-30T05:55:04Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:00.012701Z"}],"ghsa":[{"id":"GHSA-r934-m2c7-26gh","title":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19...","description":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.","status":"published","published":"2022-12-06T00:30:16Z","modified":"2025-04-24T15:30:42Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:02:00.72042Z"}],"nvd":[{"id":"CVE-2022-43548","description":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.","status":"published","published":"2022-12-05T22:15:10.923Z","modified":"2026-06-17T05:06:48.96Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:33.239526Z"}],"osv":[{"id":"ALPINE-CVE-2022-43548","description":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.","status":"published","published":"2022-12-05T22:15:10.923Z","modified":"2026-11-03T07:18:33.765008219Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-11577","title":"CVE-2022-43548 affecting package nodejs for versions less than 16.18.1-2","description":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.","status":"published","published":"2022-12-05T22:15:10Z","modified":"2026-04-21T04:22:17.120993Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"BELL-CVE-2022-43548","title":"CVE-2022-43548 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:36.20918Z","modified":"2026-02-18T07:38:27.062032Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-43548","description":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.","status":"published","published":"2022-12-05T00:00:00Z","modified":"2026-10-28T02:30:20.894289564Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"OESA-2022-2114","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in NodeJS. The issue occurs in the Node.js rebinding protector for --inspect that still allows invalid IP addresses, specifically, the octal format. This flaw allows an attacker to perform DNS rebinding and execute arbitrary code.(CVE-2022-43548)","status":"published","published":"2022-11-25T11:05:26Z","modified":"2026-08-18T01:17:28.306256559Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2022:8832","title":"Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:30:49Z","modified":"2026-10-13T10:03:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8833","title":"Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:30:48Z","modified":"2026-10-13T10:03:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:9073","title":"Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:31:15Z","modified":"2026-10-13T10:03:36Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0050","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:31:35Z","modified":"2026-10-16T10:01:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0321","title":"Red Hat Security Advisory: nodejs and nodejs-nodemon security, bug fix, and enhancement update","status":"published","published":"2024-09-29T22:06:12Z","modified":"2026-10-13T10:03:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:0612","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update","status":"published","published":"2024-09-30T14:32:48Z","modified":"2026-10-16T10:01:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1533","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:34:37Z","modified":"2026-10-13T10:04:00Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1742","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:34:46Z","modified":"2026-10-16T10:02:02Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RLSA-2022:8832","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.12.1). (BZ#2142809, BZ#2142830, BZ#2142834, BZ#2142856)\n\nSecurity Fix(es):\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-12-06T15:25:25Z","modified":"2025-10-09T05:47:19.050961Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:8833","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.12.1), nodejs-nodemon (2.0.20). (BZ#2142818)\n\nSecurity Fix(es):\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-12-06T15:25:28Z","modified":"2026-02-04T07:40:23.036325Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2022:9073","title":"Moderate: nodejs:16 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [Rocky Linux-8] (BZ#2151625)","status":"published","published":"2022-12-15T15:42:25Z","modified":"2026-02-04T17:30:10.869137Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:0050","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-09T14:24:14Z","modified":"2026-02-04T20:15:13.503848Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:0321","title":"Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.18.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)\n\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs: Packaged version of undici does not fit with declared version. [Rocky Linux-9] (BZ#2151627)","status":"published","published":"2023-01-23T14:30:11Z","modified":"2026-02-05T10:45:10.757506Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-43548","description":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.","status":"published","published":"2022-12-05T22:15:00Z","modified":"2026-04-22T13:30:32.402196Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"ALSA-2022:8832","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.12.1). (BZ#2142809, BZ#2142830, BZ#2142834, BZ#2142856)\n\nSecurity Fix(es):\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-12-06T00:00:00Z","modified":"2026-10-29T11:30:44.827992256Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:8833","title":"Moderate: nodejs:18 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (18.12.1), nodejs-nodemon (2.0.20). (BZ#2142818)\n\nSecurity Fix(es):\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-12-06T00:00:00Z","modified":"2026-10-29T11:01:55.631728128Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:9073","title":"Moderate: nodejs:16 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)\n* nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)\n* nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)\n* minimist: prototype pollution (CVE-2021-44906)\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n* nodejs: Prototype pollution via console.table properties (CVE-2022-21824)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [almalinux-8] (BZ#2151625)","status":"published","published":"2022-12-15T00:00:00Z","modified":"2026-10-29T11:01:55.56767429Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:0050","title":"Moderate: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n* node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* express: \"qs\" prototype poisoning causes the hang of the node process (CVE-2022-24999)\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-09T00:00:00Z","modified":"2026-10-29T11:01:56.071099168Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:0321","title":"Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (16.18.1), nodejs-nodemon (2.0.20).\n\nSecurity Fix(es):\n\n* minimist: prototype pollution (CVE-2021-44906)\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)\n* nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs: Packaged version of undici does not fit with declared version. [almalinux-9] (BZ#2151627)","status":"published","published":"2023-01-23T00:00:00Z","modified":"2026-10-29T11:31:22.338911326Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"BIT-node-2022-43548","description":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.","status":"published","published":"2024-03-06T11:02:30.894Z","modified":"2026-09-08T08:48:17.763019355Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2022-43548","description":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.","status":"published","published":"2024-12-16T14:00:57.711Z","modified":"2026-09-08T08:48:17.44181141Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"DEBIAN-CVE-2022-43548","description":"A OS Command Injection vulnerability exists in Node.js versions \u003c14.21.1, \u003c16.18.1, \u003c18.12.1, \u003c19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.","status":"published","published":"2022-12-05T22:15:10.923Z","modified":"2026-11-03T06:02:59.476692509Z","updated_at":"2026-11-03T06:43:01.507088Z"},{"id":"DLA-3344-1","title":"nodejs - security update","status":"published","published":"2023-02-26T00:00:00Z","modified":"2026-03-09T01:17:49.341182Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5326-1","title":"nodejs - security update","status":"published","published":"2023-01-24T00:00:00Z","modified":"2026-03-09T02:08:53.247638Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0422","title":"Updated nodejs packages fix security vulnerability","description":"DNS rebinding in --inspect via invalid octal IP address (CVE-2022-43548)\nIn addition, 14.21.0 has provided the following changes:\ndeps\n  update corepack to 0.14.2 (Node.js GitHub Bot) #44775\nsrc\n  add --openssl-shared-config option (Daniel Bevenius) #43124\n","status":"published","published":"2022-11-13T02:25:20Z","modified":"2026-04-16T04:43:17.453539124Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12488-1","title":"corepack18-18.12.1-1.1 on GA media","description":"These are all security issues fixed in the corepack18-18.12.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:45:20.303642Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12489-1","title":"corepack19-19.0.1-1.1 on GA media","description":"These are all security issues fixed in the corepack19-19.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:11:44.780778Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12554-1","title":"nodejs-electron-21.3.2-2.1 on GA media","description":"These are all security issues fixed in the nodejs-electron-21.3.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:40.038114Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2022:3967-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- Update to LTS versino 16.18.1.\n\n- CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119).\n  \n- Update to LTS version 16.18.0:\n  * http: throw error on content-length mismatch\n  * stream: add ReadableByteStream.tee()\n  * deps: npm updated to 8.19.2\n","status":"published","published":"2022-11-14T11:29:12Z","modified":"2026-02-04T04:14:19.285541Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3968-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- Update to 14.21.1:\n- CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119).\n\n- Update to 14.21.0:\n- src: add --openssl-shared-config option\n","status":"published","published":"2022-11-14T11:30:59Z","modified":"2026-02-04T04:09:19.82446Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3989-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119).\n","status":"published","published":"2022-11-15T11:59:04Z","modified":"2026-02-04T03:19:44.225381Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4003-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- Update to LTS versino 16.18.1:\n\n- CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119).\n\n- Update to LTS version 16.18.0:\n  * http: throw error on content-length mismatch\n  * stream: add ReadableByteStream.tee()\n  * deps: npm updated to 8.19.2\n","status":"published","published":"2022-11-15T16:10:03Z","modified":"2026-02-04T04:22:57.987733Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4084-1","title":"Security update for nodejs16","description":"This update for nodejs16 fixes the following issues:\n\n- Update to LTS versino 16.18.1.\n\n- CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119).\n\n- Update to LTS version 16.18.0:\n  * http: throw error on content-length mismatch\n  * stream: add ReadableByteStream.tee()\n  * deps: npm updated to 8.19.2\n","status":"published","published":"2022-11-18T15:34:25Z","modified":"2026-02-04T03:45:17.363313Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4254-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\n- CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119).\n","status":"published","published":"2022-11-28T11:29:31Z","modified":"2026-02-04T03:07:21.662248Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2022:4255-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- Update to 14.21.1:\n- CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119).\n\n- Update to 14.21.0:\n- src: add --openssl-shared-config option\n","status":"published","published":"2022-11-28T11:30:37Z","modified":"2026-02-04T03:12:06.414139Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2022:4301-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119).\n","status":"published","published":"2022-12-01T08:10:08Z","modified":"2026-02-04T02:35:38.87974Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0408-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nThis update ships nodejs18 (jsc#PED-2097)\n\nUpdate to NodejJS 18.13.0 LTS:\n\n* build: disable v8 snapshot compression by default\n* crypto: update root certificates\n* deps: update ICU to 72.1\n* doc:\n\n  + add doc-only deprecation for headers/trailers setters\n  + add Rafael to the tsc\n  + deprecate use of invalid ports in url.parse\n  + deprecate url.parse()\n\n* lib: drop fetch experimental warning\n* net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options\n* src:\n\n  + add uvwasi version\n  + add initial shadow realm support\n\n* test_runner:\n\n  + add t.after() hook\n  + don't use a symbol for runHook()\n\n* tls:\n\n  + add 'ca' property to certificate object\n\n* util:\n\n  + add fast path for utf8 encoding\n  + improve textdecoder decode performance\n  + add MIME utilities\n\n- Fixes compatibility with ICU 72.1 (bsc#1205236)\n- Fix migration to openssl-3 (bsc#1205042)\n\nUpdate to NodeJS 18.12.1 LTS:\n\n* inspector: DNS rebinding in --inspect via invalid octal IP\n  (bsc#1205119, CVE-2022-43548)\n\nUpdate to NodeJS 18.12.0 LTS:\n\n* Running in 'watch' mode using node --watch restarts the process\n  when an imported file is changed.\n* fs: add FileHandle.prototype.readLines\n* http: add writeEarlyHints function to ServerResponse\n* http2: make early hints generic\n* util: add default value option to parsearg\n\nUpdate to NodeJS 18.11.0:\n\n* added experimental watch mode -- running in 'watch' mode using\n  node --watch restarts the process when an imported file is changed\n* fs: add FileHandle.prototype.readLines\n* http: add writeEarlyHints function to ServerResponse\n* http2: make early hints generic\n* lib: refactor transferable AbortSignal\n* src: add detailed embedder process initialization API\n* util: add default value option to parsearg\n\nUpdate to NodeJS 18.10.0:\n\n* deps: upgrade npm to 8.19.2\n* http: throw error on content-length mismatch\n* stream: add ReadableByteStream.tee()\n\nUpdate to Nodejs 18.9.1:\n\n* deps: llhttp updated to 6.0.10\n\n  + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)\n  + Incorrect Parsing of Multi-line Transfer-Encoding\n    (CVE-2022-32215, bsc#1201327)\n  + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)\n\n* crypto: fix weak randomness in WebCrypto keygen\n  (CVE-2022-35255, bsc#1203831)\n\nUpdate to Nodejs 18.9.0:\n\n* lib - add diagnostics channel for process and worker\n* os - add machine method\n* report - expose report public native apis\n* src - expose environment RequestInterrupt api\n* vm - include vm context in the embedded snapshot\n\nChanges in 18.8.0:\n\n* bootstrap: implement run-time user-land snapshots via\n  --build-snapshot and --snapshot-blob. See\n* crypto:\n  + allow zero-length IKM in HKDF and in webcrypto PBKDF2\n  + allow zero-length secret KeyObject\n* deps: upgrade npm to 8.18.0\n* http: make idle http parser count configurable\n* net: add local family\n* src: print source map error source on demand\n* tls: pass a valid socket on tlsClientError\n\nUpdate to Nodejs 18.7.0:\n\n* events: add CustomEvent\n* http: add drop request event for http server\n* lib: improved diagnostics_channel subscribe/unsubscribe\n* util: add tokens to parseArgs\n\n- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)\n\nUpdate to Nodejs 18.6.0:\n\n* Experimental ESM Loader Hooks API. For details see,\n  https://nodejs.org/api/esm.html\n* dns: export error code constants from dns/promises\n* esm: add chaining to loaders\n* http: add diagnostics channel for http client\n* http: add perf_hooks detail for http request and client\n* module: add isBuiltIn method\n* net: add drop event for net server\n* test_runner: expose describe and it\n* v8: add v8.startupSnapshot utils\n\nFor details, see\nhttps://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0\n\nUpdate to Nodejs 18.5.0:\n\n* http: stricter Transfer-Encoding and header separator parsing\n  (bsc#1201325, bsc#1201326, bsc#1201327,\n   CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)\n* src: fix IPv4 validation in inspector_socket\n  (bsc#1201328, CVE-2022-32212)\n\nFor details, see\nhttps://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0\n\nUpdate to Nodejs 18.4.0. For detailed changes see,\n\nhttps://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0\n- refreshed: versioned.patch, linker_lto_jobs.patch, nodejs-libpath.patch\n\nInitial packaging of Nodejs 18.2.0. For detailed changes since previous versions, see\nhttps://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V18.md#18.2.0\n\n","status":"published","published":"2023-02-14T12:50:31Z","modified":"2026-02-04T02:44:22.619859Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0419-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\nThis update ships nodejs18 (jsc#PED-2097)\n\nUpdate to NodejJS 18.13.0 LTS:\n\n* build: disable v8 snapshot compression by default\n* crypto: update root certificates\n* deps: update ICU to 72.1\n* doc:\n\n  + add doc-only deprecation for headers/trailers setters\n  + add Rafael to the tsc\n  + deprecate use of invalid ports in url.parse\n  + deprecate url.parse()\n\n* lib: drop fetch experimental warning\n* net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options\n* src:\n\n  + add uvwasi version\n  + add initial shadow realm support\n\n* test_runner:\n\n  + add t.after() hook\n  + don't use a symbol for runHook()\n\n* tls:\n\n  + add 'ca' property to certificate object\n\n* util:\n\n  + add fast path for utf8 encoding\n  + improve textdecoder decode performance\n  + add MIME utilities\n\n- Fixes compatibility with ICU 72.1 (bsc#1205236)\n- Fix migration to openssl-3 (bsc#1205042)\n\nUpdate to NodeJS 18.12.1 LTS:\n\n* inspector: DNS rebinding in --inspect via invalid octal IP\n  (bsc#1205119, CVE-2022-43548)\n\nUpdate to NodeJS 18.12.0 LTS:\n\n* Running in 'watch' mode using node --watch restarts the process\n  when an imported file is changed.\n* fs: add FileHandle.prototype.readLines\n* http: add writeEarlyHints function to ServerResponse\n* http2: make early hints generic\n* util: add default value option to parsearg\n\nUpdate to NodeJS 18.11.0:\n\n* added experimental watch mode -- running in 'watch' mode using\n  node --watch restarts the process when an imported file is changed\n* fs: add FileHandle.prototype.readLines\n* http: add writeEarlyHints function to ServerResponse\n* http2: make early hints generic\n* lib: refactor transferable AbortSignal\n* src: add detailed embedder process initialization API\n* util: add default value option to parsearg\n\nUpdate to NodeJS 18.10.0:\n\n* deps: upgrade npm to 8.19.2\n* http: throw error on content-length mismatch\n* stream: add ReadableByteStream.tee()\n\nUpdate to Nodejs 18.9.1:\n\n* deps: llhttp updated to 6.0.10\n\n  + CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)\n  + Incorrect Parsing of Multi-line Transfer-Encoding\n    (CVE-2022-32215, bsc#1201327)\n  + Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)\n\n* crypto: fix weak randomness in WebCrypto keygen\n  (CVE-2022-35255, bsc#1203831)\n\nUpdate to Nodejs 18.9.0:\n\n* lib - add diagnostics channel for process and worker\n* os - add machine method\n* report - expose report public native apis\n* src - expose environment RequestInterrupt api\n* vm - include vm context in the embedded snapshot\n\nChanges in 18.8.0:\n\n* bootstrap: implement run-time user-land snapshots via\n  --build-snapshot and --snapshot-blob. See\n* crypto:\n  + allow zero-length IKM in HKDF and in webcrypto PBKDF2\n  + allow zero-length secret KeyObject\n* deps: upgrade npm to 8.18.0\n* http: make idle http parser count configurable\n* net: add local family\n* src: print source map error source on demand\n* tls: pass a valid socket on tlsClientError\n\nUpdate to Nodejs 18.7.0:\n\n* events: add CustomEvent\n* http: add drop request event for http server\n* lib: improved diagnostics_channel subscribe/unsubscribe\n* util: add tokens to parseArgs\n\n- enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)\n\nUpdate to Nodejs 18.6.0:\n\n* Experimental ESM Loader Hooks API. For details see,\n  https://nodejs.org/api/esm.html\n* dns: export error code constants from dns/promises\n* esm: add chaining to loaders\n* http: add diagnostics channel for http client\n* http: add perf_hooks detail for http request and client\n* module: add isBuiltIn method\n* net: add drop event for net server\n* test_runner: expose describe and it\n* v8: add v8.startupSnapshot utils\n\nFor details, see\nhttps://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0\n\nUpdate to Nodejs 18.5.0:\n\n* http: stricter Transfer-Encoding and header separator parsing\n  (bsc#1201325, bsc#1201326, bsc#1201327,\n   CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)\n* src: fix IPv4 validation in inspector_socket\n  (bsc#1201328, CVE-2022-32212)\n\nFor details, see\nhttps://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0\n\nUpdate to Nodejs 18.4.0. For detailed changes see,\n\nhttps://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0\n\nInitial packaging of Nodejs 18.2.0. For detailed changes since previous versions, see\nhttps://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V18.md#18.2.0\n\n","status":"published","published":"2023-02-15T10:45:56Z","modified":"2026-02-04T02:54:33.196207Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-6491-1","title":"nodejs vulnerabilities","description":"Axel Chong discovered that Node.js incorrectly handled certain inputs. If a\nuser or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to execute\narbitrary code. (CVE-2022-32212)\n\nZeyu Zhang discovered that Node.js incorrectly handled certain inputs. If a\nuser or an automated system were tricked into opening a specially crafted\ninput file, a remote attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-32213,\nCVE-2022-32214, CVE-2022-32215)\n\nIt was discovered that Node.js incorrectly handled certain inputs. If a user\nor an automated system were tricked into opening a specially crafted input\nfile, a remote attacker could possibly use this issue to execute arbitrary\ncode. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-35256)\n\nIt was discovered that Node.js incorrectly handled certain inputs. If a user\nor an automated system were tricked into opening a specially crafted input\nfile, a remote attacker could possibly use this issue to execute arbitrary\ncode. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-43548)\n","status":"published","published":"2023-11-21T09:15:47Z","modified":"2026-04-22T10:41:22.484931Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}