{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-02T07:32:43.845","vulnerabilities":[{"cve":{"id":"CVE-2022-43548","sourceIdentifier":"support@hackerone.com","published":"2022-12-05T22:15:10.923","lastModified":"2026-06-17T05:06:48.960","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix."},{"lang":"es","value":"Existe una vulnerabilidad de inyección de comandos del Sistema Operativo en las versiones de Node.js &lt;14.21.1, &lt;16.18.1, &lt;18.12.1, &lt;19.0.1 debido a una verificación insuficiente de IsAllowedHost que se puede omitir fácilmente porque IsIPAddress no lo hace correctamente. verifique si una dirección IP no es válida antes de realizar solicitudes de DBS que permitan volver a vincular ataques. La solución para este problema en https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 estaba incompleta y esto El nuevo CVE es para completar la solución."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"NodeJS","product":"Node","defaultStatus":"unaffected","versions":[{"version":"4.0","lessThan":"4.*","versionType":"semver","status":"affected"},{"version":"5.0","lessThan":"5.*","versionType":"semver","status":"affected"},{"version":"6.0","lessThan":"6.*","versionType":"semver","status":"affected"},{"version":"7.0","lessThan":"7.*","versionType":"semver","status":"affected"},{"version":"8.0","lessThan":"8.*","versionType":"semver","status":"affected"},{"version":"9.0","lessThan":"9.*","versionType":"semver","status":"affected"},{"version":"10.0","lessThan":"10.*","versionType":"semver","status":"affected"},{"version":"11.0","lessThan":"11.*","versionType":"semver","status":"affected"},{"version":"12.0","lessThan":"12.*","versionType":"semver","status":"affected"},{"version":"13.0","lessThan":"13.*","versionType":"semver","status":"affected"},{"version":"14.0","lessThan":"14.21.1","versionType":"semver","status":"affected"},{"version":"15.0","lessThan":"15.*","versionType":"semver","status":"affected"},{"version":"16.0","lessThan":"16.18.1","versionType":"semver","status":"affected"},{"version":"17.0","lessThan":"17.*","versionType":"semver","status":"affected"},{"version":"18.0","lessThan":"18.12.1","versionType":"semver","status":"affected"},{"version":"19.0","lessThan":"19.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-24T14:03:01.021194Z","id":"CVE-2022-43548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"14.0.0","versionEndIncluding":"14.14.0","matchCriteriaId":"428DCD7B-6F66-4F18-B780-5BD80143D482"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*","versionStartIncluding":"14.15.0","versionEndExcluding":"14.21.1","matchCriteriaId":"BE09F669-5369-442E-8B63-BF58FC0CBB22"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"16.0.0","versionEndIncluding":"16.12.0","matchCriteriaId":"1D1D0CEC-62E5-4368-B8F2-1DA5DD0B88FA"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*","versionStartIncluding":"16.13.0","versionEndExcluding":"16.18.1","matchCriteriaId":"FF081B38-0E73-4066-898D-12C6B6D48913"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"18.0.0","versionEndIncluding":"18.11.0","matchCriteriaId":"33DB62F6-9D8D-42F8-A75E-82DA091C02BC"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:18.12.0:*:*:*:lts:*:*:*","matchCriteriaId":"7B1F87EE-4E30-4832-BF01-8501E94380EE"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:19.0.0:*:*:*:-:*:*:*","matchCriteriaId":"F568BBC5-0D8E-499C-9F3E-DDCE5F10F9D5"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html","source":"support@hackerone.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/","source":"support@hackerone.com","tags":["Patch","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230120-0004/","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230427-0007/","source":"support@hackerone.com"},{"url":"https://www.debian.org/security/2023/dsa-5326","source":"support@hackerone.com","tags":["Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230120-0004/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230427-0007/","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2023/dsa-5326","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}