CVE-2022-43548

Node.js 14 and 2 others: OS Command Injection (CWE-78)

CVE-2022-43548 is fixed in 60 products on 2 platforms, first by Node.js 14 14.21.1, released November 4, 2022. It is not reported as exploited. Patch Radar priority: High.

HighFixed on 2 platforms
CVSS
9.8
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.1484
96th percentile

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix.

Where it's fixed

ProductFixed inFixReleased
Windows apps
Node.js 14 14.21.1 Node.js 14 14.21.1 Nov 4, 2022
Node.js 16 16.18.1 Node.js 16 16.18.1 Nov 4, 2022
Node.js 18 18.12.1 Node.js 18 18.12.1 Nov 4, 2022
Linux
graalvm22-ce-11 · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11 · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-devel · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-devel · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-espresso · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-espresso · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-espresso-llvm · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-espresso-llvm · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-fastr · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-fastr · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-javascript · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-javascript · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-jdk · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-jdk · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-libpolyglot · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-libpolyglot · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-llvm · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-llvm · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-llvm-toolchain · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-llvm-toolchain · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-native-image · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-native-image · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-native-image-llvm-backend · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-native-image-llvm-backend · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-nodejs · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-nodejs · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-nodejs-devel · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-nodejs-devel · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-polyglot · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-polyglot · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-python · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-python · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-python-devel · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-python-devel · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-ruby · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-ruby · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-ruby-devel · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-ruby-devel · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-tools · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-tools · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-11-wasm · ol 8 0:22.3.1-1.el8 ELSA-2023-12070 Jan 24, 2023
graalvm22-ce-11-wasm · ol 9 0:22.3.1-1.el9 ELSA-2023-12074 Jan 24, 2023
graalvm22-ce-17 · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17 · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-devel · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-devel · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-espresso · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-espresso · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-espresso-llvm · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-espresso-llvm · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-fastr · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-fastr · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-javascript · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-javascript · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-jdk · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-jdk · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-libpolyglot · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-libpolyglot · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-llvm · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-llvm · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-llvm-toolchain · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-llvm-toolchain · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-native-image · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-native-image · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-native-image-llvm-backend · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-native-image-llvm-backend · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-nodejs · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-nodejs · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-nodejs-devel · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-nodejs-devel · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-polyglot · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-polyglot · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-python · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-python · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-python-devel · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-python-devel · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-ruby · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-ruby · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-ruby-devel · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-ruby-devel · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-tools · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-tools · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
graalvm22-ce-17-wasm · ol 8 0:22.3.1-1.el8 ELSA-2023-12072 Jan 24, 2023
graalvm22-ce-17-wasm · ol 9 0:22.3.1-1.el9 ELSA-2023-12076 Jan 24, 2023
libnode64 · Ubuntu 20.04 LTS (focal) 10.19.0~dfsg-3ubuntu1.3 libnode64 10.19.0~dfsg-3ubuntu1.3 Dec 5, 2022
libnode72 · Ubuntu 22.04.1 LTS (jammy) 12.22.9~dfsg-1ubuntu3.2 libnode72 12.22.9~dfsg-1ubuntu3.2 Dec 5, 2022
nodejs · Debian 12.15 (bookworm) 18.12.1+dfsg-1 DEBIAN-CVE-2022-43548 Dec 5, 2022
nodejs · Debian 13.5 (trixie) 18.12.1+dfsg-1 DEBIAN-CVE-2022-43548 Dec 5, 2022
nodejs · Debian 14 18.12.1+dfsg-1 DEBIAN-CVE-2022-43548 Dec 5, 2022
nodejs · RHEL 8 1:14.21.1-2.module+el8.7.0+17528+a329cd47 RHSA-2023:0050 Jan 9, 2023
nodejs · RHEL 9 1:16.18.1-3.el9_1 RHSA-2023:0321 Jan 23, 2023
nodejs · Ubuntu 18.04.6 LTS (bionic) 8.10.0~dfsg-2ubuntu0.4+esm4 nodejs 8.10.0~dfsg-2ubuntu0.4+esm4 Dec 5, 2022
nodejs · Ubuntu 20.04 LTS (focal) 10.19.0~dfsg-3ubuntu1.3 nodejs 10.19.0~dfsg-3ubuntu1.3 Dec 5, 2022
nodejs · Ubuntu 22.04.1 LTS (jammy) 12.22.9~dfsg-1ubuntu3.2 nodejs 12.22.9~dfsg-1ubuntu3.2 Dec 5, 2022
nodejs · almalinux 8 1:14.21.1-2.module_el8.7.0+3373+a4c18c43 ALSA-2023:0050 Jan 9, 2023
nodejs · almalinux 9 1:16.18.1-3.el9_1 ALSA-2023:0321 Jan 23, 2023
nodejs · amzn 2023 1:18.12.1-1.amzn2023.0.2 ALAS2023-2023-084 Feb 17, 2023
nodejs · ol 8 1:18.12.1-2.module+el8.7.0+20890+579912a9 ELSA-2022-8833 Dec 8, 2022
nodejs · ol 9 1:18.12.1-1.module+el9.1.0+20891+3d7d56a4 ELSA-2022-8832 Dec 9, 2022
nodejs · rocky 8 1:14.21.1-2.module+el8.7.0+1116+bd2a84b4 RLSA-2023:0050 Jan 9, 2023
nodejs · rocky 9 1:16.18.1-3.el9_1 RLSA-2023:0321 Jan 23, 2023
nodejs-debuginfo · amzn 2023 1:18.12.1-1.amzn2023.0.2 ALAS2023-2023-084 Feb 17, 2023
nodejs-debugsource · amzn 2023 1:18.12.1-1.amzn2023.0.2 ALAS2023-2023-084 Feb 17, 2023
nodejs-devel · RHEL 8 1:14.21.1-2.module+el8.7.0+17528+a329cd47 RHSA-2023:0050 Jan 9, 2023
nodejs-devel · RHEL 9 1:18.12.1-1.module+el9.1.0.z+17326+318294bb RHSA-2022:8832 Dec 6, 2022
nodejs-devel · almalinux 8 1:14.21.1-2.module_el8.7.0+3373+a4c18c43 ALSA-2023:0050 Jan 9, 2023
nodejs-devel · almalinux 9 1:18.12.1-1.module_el9.1.0+16+91bc168f ALSA-2022:8832 Dec 6, 2022
nodejs-devel · amzn 2023 1:18.12.1-1.amzn2023.0.2 ALAS2023-2023-084 Feb 17, 2023
nodejs-devel · ol 8 1:18.12.1-2.module+el8.7.0+20890+579912a9 ELSA-2022-8833 Dec 8, 2022
nodejs-devel · ol 9 1:18.12.1-1.module+el9.1.0+20891+3d7d56a4 ELSA-2022-8832 Dec 9, 2022
nodejs-docs · RHEL 8 1:14.21.1-2.module+el8.7.0+17528+a329cd47 RHSA-2023:0050 Jan 9, 2023
nodejs-docs · RHEL 9 1:16.18.1-3.el9_1 RHSA-2023:0321 Jan 23, 2023
nodejs-docs · almalinux 8 1:14.21.1-2.module_el8.7.0+3373+a4c18c43 ALSA-2023:0050 Jan 9, 2023
nodejs-docs · almalinux 9 1:16.18.1-3.el9_1 ALSA-2023:0321 Jan 23, 2023
nodejs-docs · amzn 2023 1:18.12.1-1.amzn2023.0.2 ALAS2023-2023-084 Feb 17, 2023
nodejs-docs · ol 8 1:18.12.1-2.module+el8.7.0+20890+579912a9 ELSA-2022-8833 Dec 8, 2022
nodejs-docs · ol 9 1:18.12.1-1.module+el9.1.0+20891+3d7d56a4 ELSA-2022-8832 Dec 9, 2022
nodejs-full-i18n · RHEL 8 1:14.21.1-2.module+el8.7.0+17528+a329cd47 RHSA-2023:0050 Jan 9, 2023
nodejs-full-i18n · RHEL 9 1:16.18.1-3.el9_1 RHSA-2023:0321 Jan 23, 2023
nodejs-full-i18n · almalinux 8 1:14.21.1-2.module_el8.7.0+3373+a4c18c43 ALSA-2023:0050 Jan 9, 2023
nodejs-full-i18n · almalinux 9 1:16.18.1-3.el9_1 ALSA-2023:0321 Jan 23, 2023
nodejs-full-i18n · amzn 2023 1:18.12.1-1.amzn2023.0.2 ALAS2023-2023-084 Feb 17, 2023
nodejs-full-i18n · ol 8 1:18.12.1-2.module+el8.7.0+20890+579912a9 ELSA-2022-8833 Dec 8, 2022
nodejs-full-i18n · ol 9 1:18.12.1-1.module+el9.1.0+20891+3d7d56a4 ELSA-2022-8832 Dec 9, 2022
nodejs-libs · RHEL 9 1:16.18.1-3.el9_1 RHSA-2023:0321 Jan 23, 2023
nodejs-libs · almalinux 9 1:16.18.1-3.el9_1 ALSA-2023:0321 Jan 23, 2023
nodejs-libs · amzn 2023 1:18.12.1-1.amzn2023.0.2 ALAS2023-2023-084 Feb 17, 2023
nodejs-libs · ol 9 1:16.18.1-3.el9_1 ELSA-2023-0321 Jan 24, 2023
nodejs-libs-debuginfo · amzn 2023 1:18.12.1-1.amzn2023.0.2 ALAS2023-2023-084 Feb 17, 2023
nodejs-nodemon · RHEL 8 0:2.0.20-2.module+el8.7.0+17528+a329cd47 RHSA-2023:0050 Jan 9, 2023
nodejs-nodemon · RHEL 9 0:2.0.20-2.el9_1 RHSA-2023:0321 Jan 23, 2023
nodejs-nodemon · almalinux 8 2.0.20-2.module_el8.7.0+3373+a4c18c43 ALSA-2023:0050 Jan 9, 2023
nodejs-nodemon · almalinux 9 2.0.20-2.el9_1 ALSA-2023:0321 Jan 23, 2023
nodejs-nodemon · ol 8 0:2.0.20-1.module+el8.7.0+20890+579912a9 ELSA-2022-8833 Dec 8, 2022
nodejs-nodemon · ol 9 0:2.0.20-1.module+el9.1.0+20891+3d7d56a4 ELSA-2022-8832 Dec 9, 2022
nodejs-nodemon · rocky 8 0:2.0.20-2.module+el8.7.0+1108+49363b0d RLSA-2023:0050 Jan 9, 2023
nodejs-nodemon · rocky 9 0:2.0.20-2.el9_1 RLSA-2023:0321 Jan 23, 2023
nodejs-packaging · RHEL 8 0:23-3.module+el8.3.0+6519+9f98ed83 RHSA-2023:0050 Jan 9, 2023
nodejs-packaging · RHEL 9 0:2021.06-4.module+el9.1.0+15718+e52ec601 RHSA-2022:8832 Dec 6, 2022
nodejs-packaging · almalinux 8 23-3.module_el8.4.0+2522+3bd42762 ALSA-2023:0050 Jan 9, 2023
nodejs-packaging · almalinux 9 2021.06-4.module_el9.1.0+13+d9a595ea ALSA-2022:8832 Dec 6, 2022
nodejs-packaging · ol 8 0:2021.06-4.module+el8.7.0+20766+0a247725 ELSA-2022-8833 Dec 8, 2022
nodejs-packaging · ol 9 0:2021.06-4.module+el9.1.0+20762+f52d7401 ELSA-2022-8832 Dec 9, 2022
nodejs-packaging · rocky 8 0:23-3.module+el8.7.0+1071+4bdda2a8 RLSA-2023:0050 Jan 9, 2023
nodejs-packaging · rocky 9 0:2021.06-4.module+el9.5.0+31770+0da7192d RLSA-2022:8832 Dec 6, 2022
nodejs-packaging-bundler · RHEL 8 0:2021.06-4.module+el8.7.0+15582+19c314fa RHSA-2022:8833 Dec 6, 2022
nodejs-packaging-bundler · RHEL 9 0:2021.06-4.module+el9.1.0+15718+e52ec601 RHSA-2022:8832 Dec 6, 2022
nodejs-packaging-bundler · almalinux 8 2021.06-4.module_el8.7.0+3343+ea2b7901 ALSA-2022:8833 Dec 6, 2022
nodejs-packaging-bundler · almalinux 9 2021.06-4.module_el9.1.0+13+d9a595ea ALSA-2022:8832 Dec 6, 2022
nodejs-packaging-bundler · ol 8 0:2021.06-4.module+el8.7.0+20766+0a247725 ELSA-2022-8833 Dec 8, 2022
nodejs-packaging-bundler · ol 9 0:2021.06-4.module+el9.1.0+20762+f52d7401 ELSA-2022-8832 Dec 9, 2022
npm · RHEL 8 1:6.14.17-1.14.21.1.2.module+el8.7.0+17528+a329cd47 RHSA-2023:0050 Jan 9, 2023
npm · RHEL 9 1:8.19.2-1.16.18.1.3.el9_1 RHSA-2023:0321 Jan 23, 2023
npm · almalinux 8 1:6.14.17-1.14.21.1.2.module_el8.7.0+3373+a4c18c43 ALSA-2023:0050 Jan 9, 2023
npm · almalinux 9 1:8.19.2-1.16.18.1.3.el9_1 ALSA-2023:0321 Jan 23, 2023
npm · amzn 2023 1:8.19.2-1.18.12.1.1.amzn2023.0.2 ALAS2023-2023-084 Feb 17, 2023
npm · ol 8 1:8.19.2-1.18.12.1.2.module+el8.7.0+20890+579912a9 ELSA-2022-8833 Dec 8, 2022
npm · ol 9 1:8.19.2-1.18.12.1.1.module+el9.1.0+20891+3d7d56a4 ELSA-2022-8832 Dec 9, 2022
v8-devel · amzn 2023 2:10.2.154.15-1.18.12.1.1.amzn2023.0.2 ALAS2023-2023-084 Feb 17, 2023

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.