CVE catalog

CVE-2022-43548

nodejs: CVE-2022-43548

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
14.84% · Oct 25, 2026

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannodejssid24.22.1+dfsg+~cs24.19.2-1fixed
Debiannodejsforky24.21.0+dfsg+~cs24.13.4-1fixed
Debiannodejstrixie20.19.2+dfsg-1+deb13u2fixed
Debiannodejstrixie-security20.19.2+dfsg-1+deb13u3fixed
Debiannodejsbookworm18.20.4+dfsg-1~deb12u2fixed
Debiannodejsbookworm-security18.20.4+dfsg-1~deb12u3fixed
Ubuntunodejspro6.11.4~dfsg-1ubuntu1vulnerable
Ubuntunodejspro6.11.4~dfsg-1ubuntu2vulnerable
Ubuntunodejspro6.12.0~dfsg-1ubuntu1vulnerable
Ubuntunodejspro6.12.0~dfsg-2ubuntu1vulnerable
Ubuntunodejspro6.12.0~dfsg-2ubuntu2vulnerable
Ubuntunodejspro8.10.0~dfsg-2vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.2vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.3vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm1vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm2vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm3vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm4fixed
Ubuntunodejs20.0410.15.2~dfsg-2ubuntu1vulnerable
Ubuntunodejs20.0410.17.0~dfsg-2ubuntu4vulnerable
Ubuntunodejs20.0410.17.0~dfsg-2ubuntu6vulnerable
Ubuntunodejs20.0410.19.0~dfsg-3ubuntu1vulnerable
Ubuntunodejs20.0410.19.0~dfsg-3ubuntu1.1vulnerable
Ubuntunodejs20.0410.19.0~dfsg-3ubuntu1.2vulnerable
Ubuntunodejs20.0410.19.0~dfsg-3ubuntu1.3fixed
Ubuntunodejs22.0412.22.5~dfsg-5ubuntu1vulnerable
Ubuntunodejs22.0412.22.7~dfsg-2ubuntu1vulnerable
Ubuntunodejs22.0412.22.7~dfsg-2ubuntu3vulnerable
Ubuntunodejs22.0412.22.9~dfsg-1ubuntu2vulnerable
Ubuntunodejs22.0412.22.9~dfsg-1ubuntu3vulnerable
Ubuntunodejs22.0412.22.9~dfsg-1ubuntu3.1vulnerable
Ubuntunodejs22.0412.22.9~dfsg-1ubuntu3.2fixed
Susenodejs16linux enterprise module for web and scripting 15 sp416.18.1-150400.3.12.1fixed
Opensusenodejs16leap 15.416.18.1-150400.3.12.1fixed
Susenodejs16linux enterprise module for web and scripting 1216.18.1-8.17.1fixed
Opensusenodejs19tumbleweed19.0.1-1.1fixed
Susenodejs14linux enterprise module for web and scripting 1214.21.1-6.37.1fixed
Opensusenodejs18tumbleweed18.12.1-1.1fixed
Susenodejs16linux enterprise module for web and scripting 15 sp316.18.1-150300.7.15.1fixed
Opensusenodejs16leap 15.316.18.1-150300.7.15.1fixed
Susenodejs12linux enterprise module for web and scripting 1212.22.12-1.57.1fixed
Susenodejs14linux enterprise module for web and scripting 15 sp314.21.1-150200.15.40.2fixed
Susenodejs14linux enterprise high performance computing 15 sp2-espos14.21.1-150200.15.40.2fixed
Susenodejs14linux enterprise high performance computing 15 sp2-ltss14.21.1-150200.15.40.2fixed
Susenodejs14linux enterprise server 15 sp2-bcl14.21.1-150200.15.40.2fixed
Susenodejs14linux enterprise server 15 sp2-ltss14.21.1-150200.15.40.2fixed
Susenodejs14linux enterprise server for sap applications 15 sp214.21.1-150200.15.40.2fixed
Susenodejs14manager proxy 4.114.21.1-150200.15.40.2fixed
Susenodejs14manager retail branch server 4.114.21.1-150200.15.40.2fixed
Susenodejs14manager server 4.114.21.1-150200.15.40.2fixed
Susenodejs14enterprise storage 714.21.1-150200.15.40.2fixed
Opensusenodejs14leap 15.314.21.1-150200.15.40.2fixed
Opensusenodejs14leap 15.414.21.1-150200.15.40.2fixed
Susenodejs12linux enterprise module for web and scripting 15 sp312.22.12-150200.4.41.2fixed
Susenodejs12linux enterprise high performance computing 15 sp2-espos12.22.12-150200.4.41.2fixed
Susenodejs12linux enterprise high performance computing 15 sp2-ltss12.22.12-150200.4.41.2fixed
Susenodejs12linux enterprise server 15 sp2-bcl12.22.12-150200.4.41.2fixed
Susenodejs12linux enterprise server 15 sp2-ltss12.22.12-150200.4.41.2fixed
Susenodejs12linux enterprise server for sap applications 15 sp212.22.12-150200.4.41.2fixed
Susenodejs12manager proxy 4.112.22.12-150200.4.41.2fixed
Susenodejs12manager retail branch server 4.112.22.12-150200.4.41.2fixed
Susenodejs12manager server 4.112.22.12-150200.4.41.2fixed
Susenodejs12enterprise storage 712.22.12-150200.4.41.2fixed
Opensusenodejs12leap 15.312.22.12-150200.4.41.2fixed
Opensusenodejs12leap 15.412.22.12-150200.4.41.2fixed
Opensusenodejs-electrontumbleweed21.3.2-2.1fixed
Susenodejs10linux enterprise high performance computing 15-espos10.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise high performance computing 15-ltss10.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise high performance computing 15 sp1-espos10.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise high performance computing 15 sp1-ltss10.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise high performance computing 15 sp2-espos10.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise high performance computing 15 sp2-ltss10.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise server 15-ltss10.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise server 15 sp1-bcl10.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise server 15 sp1-ltss10.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise server 15 sp2-bcl10.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise server 15 sp2-ltss10.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise server for sap applications 1510.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise server for sap applications 15 sp110.24.1-150000.1.53.1fixed
Susenodejs10linux enterprise server for sap applications 15 sp210.24.1-150000.1.53.1fixed
Susenodejs10manager proxy 4.110.24.1-150000.1.53.1fixed
Susenodejs10manager retail branch server 4.110.24.1-150000.1.53.1fixed
Susenodejs10manager server 4.110.24.1-150000.1.53.1fixed
Susenodejs10enterprise storage 610.24.1-150000.1.53.1fixed
Susenodejs10enterprise storage 710.24.1-150000.1.53.1fixed
Opensusenodejs10leap 15.310.24.1-150000.1.53.1fixed
Opensusenodejs10leap 15.410.24.1-150000.1.53.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannodejssourcesid18.12.1+dfsg-1not yet assignedNot reported[1023518]
Debiannodejssourceforky18.12.1+dfsg-1not yet assignedNot reported[1023518]
Debiannodejssourcetrixie18.12.1+dfsg-1not yet assignedNot reported[1023518]
Debiannodejssourcebookworm18.12.1+dfsg-1not yet assignedNot reported[1023518]
Ubuntunodejsdebpro8.10.0~dfsg-2ubuntu0.4+esm4Not reportedUBUNTU-CVE-2022-43548Not reported
Ubuntunodejsdeb20.0410.19.0~dfsg-3ubuntu1.3Not reportedUBUNTU-CVE-2022-43548Not reported
Ubuntunodejsdeb22.0412.22.9~dfsg-1ubuntu3.2Not reportedUBUNTU-CVE-2022-43548Not reported
Susenodejs16rpmlinux enterprise module for web and scripting 15 sp416.18.1-150400.3.12.1Not reportedSUSE-SU-2022:4003-1Not reported
Opensusenodejs16rpmleap 15.416.18.1-150400.3.12.1Not reportedSUSE-SU-2022:4003-1Not reported
Susenodejs16rpmlinux enterprise module for web and scripting 1216.18.1-8.17.1Not reportedSUSE-SU-2022:3967-1Not reported
Opensusenodejs19rpmtumbleweed19.0.1-1.1Not reportedOPENSUSE-SU-2024:12489-1Not reported
Susenodejs14rpmlinux enterprise module for web and scripting 1214.21.1-6.37.1Not reportedSUSE-SU-2022:3968-1Not reported
Opensusenodejs18rpmtumbleweed18.12.1-1.1Not reportedOPENSUSE-SU-2024:12488-1Not reported
Susenodejs16rpmlinux enterprise module for web and scripting 15 sp316.18.1-150300.7.15.1Not reportedSUSE-SU-2022:4084-1Not reported
Opensusenodejs16rpmleap 15.316.18.1-150300.7.15.1Not reportedSUSE-SU-2022:4084-1Not reported
Susenodejs12rpmlinux enterprise module for web and scripting 1212.22.12-1.57.1Not reportedSUSE-SU-2022:3989-1Not reported
Susenodejs14rpmlinux enterprise module for web and scripting 15 sp314.21.1-150200.15.40.2Not reportedSUSE-SU-2022:4255-1Not reported
Susenodejs14rpmlinux enterprise high performance computing 15 sp2-espos14.21.1-150200.15.40.2Not reportedSUSE-SU-2022:4255-1Not reported
Susenodejs14rpmlinux enterprise high performance computing 15 sp2-ltss14.21.1-150200.15.40.2Not reportedSUSE-SU-2022:4255-1Not reported
Susenodejs14rpmlinux enterprise server 15 sp2-bcl14.21.1-150200.15.40.2Not reportedSUSE-SU-2022:4255-1Not reported
Susenodejs14rpmlinux enterprise server 15 sp2-ltss14.21.1-150200.15.40.2Not reportedSUSE-SU-2022:4255-1Not reported
Susenodejs14rpmlinux enterprise server for sap applications 15 sp214.21.1-150200.15.40.2Not reportedSUSE-SU-2022:4255-1Not reported
Susenodejs14rpmmanager proxy 4.114.21.1-150200.15.40.2Not reportedSUSE-SU-2022:4255-1Not reported
Susenodejs14rpmmanager retail branch server 4.114.21.1-150200.15.40.2Not reportedSUSE-SU-2022:4255-1Not reported
Susenodejs14rpmmanager server 4.114.21.1-150200.15.40.2Not reportedSUSE-SU-2022:4255-1Not reported
Susenodejs14rpmenterprise storage 714.21.1-150200.15.40.2Not reportedSUSE-SU-2022:4255-1Not reported
Opensusenodejs14rpmleap 15.314.21.1-150200.15.40.2Not reportedSUSE-SU-2022:4255-1Not reported
Opensusenodejs14rpmleap 15.414.21.1-150200.15.40.2Not reportedSUSE-SU-2022:4255-1Not reported
Susenodejs12rpmlinux enterprise module for web and scripting 15 sp312.22.12-150200.4.41.2Not reportedSUSE-SU-2022:4254-1Not reported
Susenodejs12rpmlinux enterprise high performance computing 15 sp2-espos12.22.12-150200.4.41.2Not reportedSUSE-SU-2022:4254-1Not reported
Susenodejs12rpmlinux enterprise high performance computing 15 sp2-ltss12.22.12-150200.4.41.2Not reportedSUSE-SU-2022:4254-1Not reported
Susenodejs12rpmlinux enterprise server 15 sp2-bcl12.22.12-150200.4.41.2Not reportedSUSE-SU-2022:4254-1Not reported
Susenodejs12rpmlinux enterprise server 15 sp2-ltss12.22.12-150200.4.41.2Not reportedSUSE-SU-2022:4254-1Not reported
Susenodejs12rpmlinux enterprise server for sap applications 15 sp212.22.12-150200.4.41.2Not reportedSUSE-SU-2022:4254-1Not reported
Susenodejs12rpmmanager proxy 4.112.22.12-150200.4.41.2Not reportedSUSE-SU-2022:4254-1Not reported
Susenodejs12rpmmanager retail branch server 4.112.22.12-150200.4.41.2Not reportedSUSE-SU-2022:4254-1Not reported
Susenodejs12rpmmanager server 4.112.22.12-150200.4.41.2Not reportedSUSE-SU-2022:4254-1Not reported
Susenodejs12rpmenterprise storage 712.22.12-150200.4.41.2Not reportedSUSE-SU-2022:4254-1Not reported
Opensusenodejs12rpmleap 15.312.22.12-150200.4.41.2Not reportedSUSE-SU-2022:4254-1Not reported
Opensusenodejs12rpmleap 15.412.22.12-150200.4.41.2Not reportedSUSE-SU-2022:4254-1Not reported
Opensusenodejs-electronrpmtumbleweed21.3.2-2.1Not reportedOPENSUSE-SU-2024:12554-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15-espos10.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15-ltss10.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15 sp1-espos10.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15 sp1-ltss10.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15 sp2-espos10.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15 sp2-ltss10.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise server 15-ltss10.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise server 15 sp1-bcl10.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise server 15 sp1-ltss10.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise server 15 sp2-bcl10.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise server 15 sp2-ltss10.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise server for sap applications 1510.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise server for sap applications 15 sp110.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmlinux enterprise server for sap applications 15 sp210.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmmanager proxy 4.110.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmmanager retail branch server 4.110.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmmanager server 4.110.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmenterprise storage 610.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Susenodejs10rpmenterprise storage 710.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Opensusenodejs10rpmleap 15.310.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported
Opensusenodejs10rpmleap 15.410.24.1-150000.1.53.1Not reportedSUSE-SU-2022:4301-1Not reported

[Debian bug #1023518]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libnode108]Unknown

    Source package: [nodejs]

    Details (4)
    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

  • [libnode-dev]Unknown

    Source package: [nodejs]

    Details (4)
    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

  • [nodejs]Unknown
    Details (4)
    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

  • [nodejs-doc]Unknown

    Source package: [nodejs]

    Details (4)
    • 18.20.4+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 18.12.1+dfsg-1

      dsa · nodejs · debian · bookworm

[openSUSE Tumbleweed]

  • Source package: [nodejs-electron]

    Details (1)
    • 37.10.2-3.11 · x86_64 · tumbleweed

      Fixed · Fixed: 21.3.2-2.1

      dsa · nodejs-electron · opensuse · tumbleweed

  • Source package: [nodejs-electron]

    Details (1)
    • 37.10.2-3.11 · x86_64 · tumbleweed

      Unknown · Fixed: 21.3.2-2.1

      Version impact unknown

      dsa · nodejs-electron · opensuse · tumbleweed

  • Source package: [nodejs-electron]

    Details (1)
    • 37.10.2-3.11 · noarch · tumbleweed

      Unknown · Fixed: 21.3.2-2.1

      Version impact unknown

      dsa · nodejs-electron · opensuse · tumbleweed

Observed:

References