CVE-2022-43548

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-43548
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-43548.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-43548
Aliases
Downstream
Related
Published
2022-12-05T22:15:10Z
Modified
2025-09-19T14:15:33.040097Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

References

Affected packages

Alpine:v3.17

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.12.1-r0

Affected versions

4.*

4.4.3-r0
4.4.4-r0
4.4.5-r0
4.4.7-r0
4.5.0-r0

6.*

6.9.1-r0
6.9.1-r1
6.9.2-r0
6.9.4-r0
6.9.4-r1
6.9.5-r0
6.9.5-r1
6.10.0-r0
6.10.1-r0
6.10.3-r0
6.11.0-r0
6.11.1-r0
6.11.1-r1
6.11.1-r2
6.11.2-r0
6.11.3-r0
6.11.4-r0
6.11.5-r0

8.*

8.9.0-r0
8.9.1-r0
8.9.2-r0
8.9.3-r0
8.9.3-r1
8.9.4-r0
8.10.0-r0
8.11.0-r0
8.11.0-r1
8.11.1-r0
8.11.1-r1
8.11.1-r2
8.11.2-r0
8.11.3-r0
8.11.3-r1
8.11.3-r2
8.11.3-r3
8.11.4-r0
8.12.0-r0

10.*

10.13.0-r0
10.14.0-r0
10.14.1-r0
10.14.2-r0
10.15.1-r0
10.15.3-r0
10.16.0-r0
10.16.1-r0
10.16.2-r0
10.16.3-r0

12.*

12.13.0-r0
12.13.0-r1
12.13.1-r0
12.14.0-r0
12.14.1-r0
12.15.0-r0
12.15.0-r1
12.15.0-r2
12.16.2-r0
12.16.3-r0
12.16.3-r1
12.17.0-r0
12.18.0-r0
12.18.0-r1
12.18.0-r2
12.18.2-r0
12.18.3-r0
12.18.4-r0
12.19.0-r0

14.*

14.15.1-r0
14.15.3-r0
14.15.3-r1
14.15.3-r2
14.15.4-r0
14.15.5-r0
14.16.0-r0
14.16.0-r1
14.16.1-r0
14.16.1-r1
14.16.1-r2
14.17.0-r0
14.17.1-r0
14.17.2-r0
14.17.3-r0
14.17.4-r0
14.17.5-r0
14.17.6-r0
14.17.6-r1
14.18.0-r0
14.18.1-r0
14.18.1-r1

16.*

16.13.0-r0
16.13.1-r0
16.13.1-r1
16.13.2-r0
16.13.2-r1
16.14.2-r0
16.14.2-r1
16.15.0-r0
16.15.0-r1
16.16.0-r0
16.16.0-r1
16.17.0-r0
16.17.1-r0
16.18.0-r0
16.18.0-r1

18.*

18.12.0-r0

Alpine:v3.18

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.12.1-r0

Affected versions

4.*

4.4.3-r0
4.4.4-r0
4.4.5-r0
4.4.7-r0
4.5.0-r0

6.*

6.9.1-r0
6.9.1-r1
6.9.2-r0
6.9.4-r0
6.9.4-r1
6.9.5-r0
6.9.5-r1
6.10.0-r0
6.10.1-r0
6.10.3-r0
6.11.0-r0
6.11.1-r0
6.11.1-r1
6.11.1-r2
6.11.2-r0
6.11.3-r0
6.11.4-r0
6.11.5-r0

8.*

8.9.0-r0
8.9.1-r0
8.9.2-r0
8.9.3-r0
8.9.3-r1
8.9.4-r0
8.10.0-r0
8.11.0-r0
8.11.0-r1
8.11.1-r0
8.11.1-r1
8.11.1-r2
8.11.2-r0
8.11.3-r0
8.11.3-r1
8.11.3-r2
8.11.3-r3
8.11.4-r0
8.12.0-r0

10.*

10.13.0-r0
10.14.0-r0
10.14.1-r0
10.14.2-r0
10.15.1-r0
10.15.3-r0
10.16.0-r0
10.16.1-r0
10.16.2-r0
10.16.3-r0

12.*

12.13.0-r0
12.13.0-r1
12.13.1-r0
12.14.0-r0
12.14.1-r0
12.15.0-r0
12.15.0-r1
12.15.0-r2
12.16.2-r0
12.16.3-r0
12.16.3-r1
12.17.0-r0
12.18.0-r0
12.18.0-r1
12.18.0-r2
12.18.2-r0
12.18.3-r0
12.18.4-r0
12.19.0-r0

14.*

14.15.1-r0
14.15.3-r0
14.15.3-r1
14.15.3-r2
14.15.4-r0
14.15.5-r0
14.16.0-r0
14.16.0-r1
14.16.1-r0
14.16.1-r1
14.16.1-r2
14.17.0-r0
14.17.1-r0
14.17.2-r0
14.17.3-r0
14.17.4-r0
14.17.5-r0
14.17.6-r0
14.17.6-r1
14.18.0-r0
14.18.1-r0
14.18.1-r1

16.*

16.13.0-r0
16.13.1-r0
16.13.1-r1
16.13.2-r0
16.13.2-r1
16.14.2-r0
16.14.2-r1
16.15.0-r0
16.15.0-r1
16.16.0-r0
16.16.0-r1
16.17.0-r0
16.17.1-r0
16.18.0-r0
16.18.0-r1

18.*

18.12.0-r0

Alpine:v3.19

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.12.1-r0

Affected versions

4.*

4.4.3-r0
4.4.4-r0
4.4.5-r0
4.4.7-r0
4.5.0-r0

6.*

6.9.1-r0
6.9.1-r1
6.9.2-r0
6.9.4-r0
6.9.4-r1
6.9.5-r0
6.9.5-r1
6.10.0-r0
6.10.1-r0
6.10.3-r0
6.11.0-r0
6.11.1-r0
6.11.1-r1
6.11.1-r2
6.11.2-r0
6.11.3-r0
6.11.4-r0
6.11.5-r0

8.*

8.9.0-r0
8.9.1-r0
8.9.2-r0
8.9.3-r0
8.9.3-r1
8.9.4-r0
8.10.0-r0
8.11.0-r0
8.11.0-r1
8.11.1-r0
8.11.1-r1
8.11.1-r2
8.11.2-r0
8.11.3-r0
8.11.3-r1
8.11.3-r2
8.11.3-r3
8.11.4-r0
8.12.0-r0

10.*

10.13.0-r0
10.14.0-r0
10.14.1-r0
10.14.2-r0
10.15.1-r0
10.15.3-r0
10.16.0-r0
10.16.1-r0
10.16.2-r0
10.16.3-r0

12.*

12.13.0-r0
12.13.0-r1
12.13.1-r0
12.14.0-r0
12.14.1-r0
12.15.0-r0
12.15.0-r1
12.15.0-r2
12.16.2-r0
12.16.3-r0
12.16.3-r1
12.17.0-r0
12.18.0-r0
12.18.0-r1
12.18.0-r2
12.18.2-r0
12.18.3-r0
12.18.4-r0
12.19.0-r0

14.*

14.15.1-r0
14.15.3-r0
14.15.3-r1
14.15.3-r2
14.15.4-r0
14.15.5-r0
14.16.0-r0
14.16.0-r1
14.16.1-r0
14.16.1-r1
14.16.1-r2
14.17.0-r0
14.17.1-r0
14.17.2-r0
14.17.3-r0
14.17.4-r0
14.17.5-r0
14.17.6-r0
14.17.6-r1
14.18.0-r0
14.18.1-r0
14.18.1-r1

16.*

16.13.0-r0
16.13.1-r0
16.13.1-r1
16.13.2-r0
16.13.2-r1
16.14.2-r0
16.14.2-r1
16.15.0-r0
16.15.0-r1
16.16.0-r0
16.16.0-r1
16.17.0-r0
16.17.1-r0
16.18.0-r0
16.18.0-r1

18.*

18.12.0-r0

Alpine:v3.20

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.12.1-r0

Affected versions

4.*

4.4.3-r0
4.4.4-r0
4.4.5-r0
4.4.7-r0
4.5.0-r0

6.*

6.9.1-r0
6.9.1-r1
6.9.2-r0
6.9.4-r0
6.9.4-r1
6.9.5-r0
6.9.5-r1
6.10.0-r0
6.10.1-r0
6.10.3-r0
6.11.0-r0
6.11.1-r0
6.11.1-r1
6.11.1-r2
6.11.2-r0
6.11.3-r0
6.11.4-r0
6.11.5-r0

8.*

8.9.0-r0
8.9.1-r0
8.9.2-r0
8.9.3-r0
8.9.3-r1
8.9.4-r0
8.10.0-r0
8.11.0-r0
8.11.0-r1
8.11.1-r0
8.11.1-r1
8.11.1-r2
8.11.2-r0
8.11.3-r0
8.11.3-r1
8.11.3-r2
8.11.3-r3
8.11.4-r0
8.12.0-r0

10.*

10.13.0-r0
10.14.0-r0
10.14.1-r0
10.14.2-r0
10.15.1-r0
10.15.3-r0
10.16.0-r0
10.16.1-r0
10.16.2-r0
10.16.3-r0

12.*

12.13.0-r0
12.13.0-r1
12.13.1-r0
12.14.0-r0
12.14.1-r0
12.15.0-r0
12.15.0-r1
12.15.0-r2
12.16.2-r0
12.16.3-r0
12.16.3-r1
12.17.0-r0
12.18.0-r0
12.18.0-r1
12.18.0-r2
12.18.2-r0
12.18.3-r0
12.18.4-r0
12.19.0-r0

14.*

14.15.1-r0
14.15.3-r0
14.15.3-r1
14.15.3-r2
14.15.4-r0
14.15.5-r0
14.16.0-r0
14.16.0-r1
14.16.1-r0
14.16.1-r1
14.16.1-r2
14.17.0-r0
14.17.1-r0
14.17.2-r0
14.17.3-r0
14.17.4-r0
14.17.5-r0
14.17.6-r0
14.17.6-r1
14.18.0-r0
14.18.1-r0
14.18.1-r1

16.*

16.13.0-r0
16.13.1-r0
16.13.1-r1
16.13.2-r0
16.13.2-r1
16.14.2-r0
16.14.2-r1
16.15.0-r0
16.15.0-r1
16.16.0-r0
16.16.0-r1
16.17.0-r0
16.17.1-r0
16.18.0-r0
16.18.0-r1

18.*

18.12.0-r0

Alpine:v3.21

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.12.1-r0

Alpine:v3.22

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.12.1-r0

Git

github.com/nodejs/node

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/node
Events

Affected versions

v14.*

v14.15.0
v14.15.1
v14.15.2
v14.15.3
v14.15.4
v14.15.5
v14.16.0
v14.16.1
v14.17.0
v14.17.1
v14.17.2
v14.17.3
v14.17.4
v14.17.5
v14.17.6
v14.18.0
v14.18.1
v14.18.2
v14.18.3
v14.19.0
v14.19.1
v14.19.2
v14.19.3
v14.20.0
v14.20.1
v14.21.0