Catalogue CVE

CVE-2022-29167

node-hawk affected and fixed versions

Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.

Gravité: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: May 5, 2022, 11:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.10% · Oct 27, 2026

Projects and upstream resources

[node-hawk][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	node-hawk	`9.0.1-1`	FixedDistribution-reported fixed boundary	[CVE-2022-29167]
Debiansid	node-hawk	`9.0.1-1`	FixedDistribution-reported fixed boundary	[CVE-2022-29167]
Debiansid	node-hawk	`9.0.2-1`	Fixed	[CVE-2022-29167]
Debianforky	node-hawk	`9.0.1-1`	FixedDistribution-reported fixed boundary	[CVE-2022-29167]
Debianforky	node-hawk	`9.0.2-1`	Fixed	[CVE-2022-29167]
Debianbookworm	node-hawk	`9.0.1-1`	FixedDistribution-reported fixed boundary	[CVE-2022-29167]

Showing 6 fix observations. All 14 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
NpmRelease not reported	hawk	`9.0.1`	UnknownSource applicability is not established	Provider not reported
Debianbookworm	node-hawk	`9.0.1-1`	FixedDistribution-reported fixed boundary	[CVE-2022-29167]
Debianforky	node-hawk	`9.0.1-1`	FixedDistribution-reported fixed boundary	[CVE-2022-29167]
Debianforky	node-hawk	`9.0.2-1`	Fixed	[CVE-2022-29167]
Debiansid	node-hawk	`9.0.1-1`	FixedDistribution-reported fixed boundary	[CVE-2022-29167]
Debiansid	node-hawk	`9.0.2-1`	Fixed	[CVE-2022-29167]
Debiantrixie	node-hawk	`9.0.1-1`	FixedDistribution-reported fixed boundary	[CVE-2022-29167]
Ubuntu18.04	node-hawk	`6.0.1+dfsg-1`	UnknownSource applicability is not established	[USN-6116-1]Feb 10, 2026, 4:43:08 AM UTC[UBUNTU-CVE-2022-29167]Feb 4, 2026, 3:56:02 AM UTC
Ubuntu18.04	node-hawk	`6.0.1+dfsg-1+deb10u1build0.18.04.1`	UnknownSource applicability is not established	[USN-6116-1]Feb 10, 2026, 4:43:08 AM UTC[UBUNTU-CVE-2022-29167]Feb 4, 2026, 3:56:02 AM UTC
Ubuntu20.04	node-hawk	`7.1.1+dfsg-2`	UnknownSource applicability is not established	[USN-6116-1]Feb 10, 2026, 4:43:08 AM UTC[UBUNTU-CVE-2022-29167]Feb 4, 2026, 3:56:02 AM UTC
Ubuntu20.04	node-hawk	`7.1.2+dfsg-1`	UnknownSource applicability is not established	[USN-6116-1]Feb 10, 2026, 4:43:08 AM UTC[UBUNTU-CVE-2022-29167]Feb 4, 2026, 3:56:02 AM UTC
Ubuntu20.04	node-hawk	`7.1.2+dfsg-1ubuntu0.1`	UnknownSource applicability is not established	[USN-6116-1]Feb 10, 2026, 4:43:08 AM UTC[UBUNTU-CVE-2022-29167]Feb 4, 2026, 3:56:02 AM UTC
Ubuntu22.04	node-hawk	`8.0.1+dfsg-1`	UnknownSource applicability is not established	[USN-6116-1]Feb 10, 2026, 4:43:08 AM UTC[UBUNTU-CVE-2022-29167]Feb 4, 2026, 3:56:02 AM UTC
Ubuntu22.04	node-hawk	`8.0.1+dfsg-1ubuntu0.22.04.1`	UnknownSource applicability is not established	[USN-6116-1]Feb 10, 2026, 4:43:08 AM UTC[UBUNTU-CVE-2022-29167]Feb 4, 2026, 3:56:02 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "node-hawk",
      "status": "fixed",
      "release": "sid",
      "version": "9.0.2-1"
    },
    {
      "name": "node-hawk",
      "status": "fixed",
      "release": "forky",
      "version": "9.0.2-1"
    },
    {
      "name": "node-hawk",
      "status": "fixed",
      "release": "trixie",
      "version": "9.0.1-1"
    },
    {
      "name": "node-hawk",
      "status": "fixed",
      "release": "bookworm",
      "version": "9.0.1-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "node-hawk",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "9.0.1-1"
    },
    {
      "bug": null,
      "name": "node-hawk",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "9.0.1-1"
    },
    {
      "bug": null,
      "name": "node-hawk",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "9.0.1-1"
    },
    {
      "bug": null,
      "name": "node-hawk",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "9.0.1-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "hawk",
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0.1"
            }
          ]
        }
      ],
      "ecosystem": "npm",
      "fixed_version": "9.0.1",
      "applicability_unknown": true
    },
    {
      "name": "node-hawk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.1+dfsg-1+deb10u1build0.18.04.1"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "6.0.1+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6116-1",
      "fixed_version": "6.0.1+dfsg-1+deb10u1build0.18.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6116-1",
      "provider_updated_at": "2026-02-10T04:43:08Z",
      "applicability_unknown": true
    },
    {
      "name": "node-hawk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.2+dfsg-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "7.1.1+dfsg-2",
        "7.1.2+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6116-1",
      "fixed_version": "7.1.2+dfsg-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6116-1",
      "provider_updated_at": "2026-02-10T04:43:08Z",
      "applicability_unknown": true
    },
    {
      "name": "node-hawk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.1+dfsg-1ubuntu0.22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "8.0.1+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-6116-1",
      "fixed_version": "8.0.1+dfsg-1ubuntu0.22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-6116-1",
      "provider_updated_at": "2026-02-10T04:43:08Z",
      "applicability_unknown": true
    },
    {
      "name": "node-hawk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.1+dfsg-1+deb10u1build0.18.04.1"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "6.0.1+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-29167",
      "fixed_version": "6.0.1+dfsg-1+deb10u1build0.18.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-29167",
      "provider_updated_at": "2026-02-04T03:56:02.354564Z",
      "applicability_unknown": true
    },
    {
      "name": "node-hawk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.2+dfsg-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "7.1.1+dfsg-2",
        "7.1.2+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-29167",
      "fixed_version": "7.1.2+dfsg-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-29167",
      "provider_updated_at": "2026-02-04T03:56:02.354564Z",
      "applicability_unknown": true
    },
    {
      "name": "node-hawk",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.1+dfsg-1ubuntu0.22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "8.0.1+dfsg-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-29167",
      "fixed_version": "8.0.1+dfsg-1ubuntu0.22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-29167",
      "provider_updated_at": "2026-02-04T03:56:02.354564Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

L’association des paquets est en cours.

[Debian 12 (Bookworm)]

[node-hawk]Inconnu
Détails (2)
- 9.0.1-1 · all · bookworm
  Corrigée · Corrigée: 9.0.1-1
  dsa · node-hawk · debian · bookworm
- 9.0.1-1 · all · bookworm
  Corrigée · Corrigée: 9.0.1-1
  dsa · node-hawk · debian · bookworm

Observé: Oct 23, 2026, 6:26:13 PM UTC

Références

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]