{
  "cveId": "CVE-2022-29167",
  "url": "https://patchblox.com/security/cve/CVE-2022-29167",
  "summary": "CVE-2022-29167 is fixed in node-hawk on 1 platform, first by node-hawk 6.0.1\u002Bdfsg-1\u002Bdeb10u1build0.18.04.1, released May 5, 2022. It is not reported as exploited. Patch Radar priority: High.",
  "title": "node-hawk: Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial crypto...",
  "description": "Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse \u0060Host\u0060 HTTP header (\u0060Hawk.utils.parseHost()\u0060), which was subject to regular expression DoS attack - meaning each added character in the attacker\u0027s input increases the computation time exponentially. \u0060parseHost()\u0060 was patched in \u00609.0.1\u0060 to use built-in \u0060URL\u0060 class to parse hostname instead. \u0060Hawk.authenticate()\u0060 accepts \u0060options\u0060 argument. If that contains \u0060host\u0060 and \u0060port\u0060, those would be used instead of a call to \u0060utils.parseHost()\u0060.",
  "published": "2022-05-05T16:15:00Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.01101,
  "epssPercentile": 0.65896,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-hawk",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "9.0.1-1",
      "fix": "DEBIAN-CVE-2022-29167",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-29167",
      "released": "2022-05-05T23:15:09Z"
    },
    {
      "platform": "linux",
      "product": "node-hawk",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "9.0.1-1",
      "fix": "DEBIAN-CVE-2022-29167",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-29167",
      "released": "2022-05-05T23:15:09Z"
    },
    {
      "platform": "linux",
      "product": "node-hawk",
      "release": "Debian 14",
      "fixedVersion": "9.0.1-1",
      "fix": "DEBIAN-CVE-2022-29167",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-29167",
      "released": "2022-05-05T23:15:09Z"
    },
    {
      "platform": "linux",
      "product": "node-hawk",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "6.0.1\u002Bdfsg-1\u002Bdeb10u1build0.18.04.1",
      "fix": "node-hawk 6.0.1\u002Bdfsg-1\u002Bdeb10u1build0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-node-hawk-6.0.1-dfsg-1-deb10u1build0.18.04.1",
      "released": "2022-05-05T16:15:00Z"
    },
    {
      "platform": "linux",
      "product": "node-hawk",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "7.1.2\u002Bdfsg-1ubuntu0.1",
      "fix": "node-hawk 7.1.2\u002Bdfsg-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-node-hawk-7.1.2-dfsg-1ubuntu0.1",
      "released": "2022-05-05T16:15:00Z"
    },
    {
      "platform": "linux",
      "product": "node-hawk",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "8.0.1\u002Bdfsg-1ubuntu0.22.04.1",
      "fix": "node-hawk 8.0.1\u002Bdfsg-1ubuntu0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-node-hawk-8.0.1-dfsg-1ubuntu0.22.04.1",
      "released": "2022-05-05T16:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}