{
  "cveId": "CVE-2022-32223",
  "url": "https://patchblox.com/security/cve/CVE-2022-32223",
  "summary": "CVE-2022-32223 is fixed in 13 products on 2 platforms, first by Node.js 18 18.2.0, released May 17, 2022. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Node.js 14 and 2 others: Uncontrolled Search Path Element (CWE-427)",
  "description": "Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and \u201CC:\\Program Files\\Common Files\\SSL\\openssl.cnf\u201D exists.Whenever the above conditions are present, \u0060node.exe\u0060 will search for \u0060providers.dll\u0060 in the current user directory.After that, \u0060node.exe\u0060 will try to search for \u0060providers.dll\u0060 by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file \u0060providers.dll\u0060 under a variety of paths and exploit this vulnerability.",
  "published": "2022-07-14T15:15:08Z",
  "severity": "important",
  "cvss": 7.3,
  "cwe": "CWE-427: Uncontrolled Search Path Element (CWE-427)",
  "epss": 0.01752,
  "epssPercentile": 0.78033,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2022-32223",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Node.js 14",
      "fixedVersion": "14.20.0",
      "fix": "Node.js 14 14.20.0",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.14-14.20.0",
      "released": "2022-07-07T00:00:00Z"
    },
    {
      "platform": "windows-app",
      "product": "Node.js 16",
      "fixedVersion": "16.16.0",
      "fix": "Node.js 16 16.16.0",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.16-16.16.0",
      "released": "2022-07-07T00:00:00Z"
    },
    {
      "platform": "windows-app",
      "product": "Node.js 18",
      "fixedVersion": "18.2.0",
      "fix": "Node.js 18 18.2.0",
      "url": "https://patchblox.com/security/fix/windows-app/openjs.nodejs.18-18.2.0",
      "released": "2022-05-17T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-devel",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-docs",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-full-i18n",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-libs",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "nodejs-libs-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1:18.12.1-1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "npm",
      "release": "amzn 2023",
      "fixedVersion": "1:8.19.2-1.18.12.1.1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    },
    {
      "platform": "linux",
      "product": "v8-devel",
      "release": "amzn 2023",
      "fixedVersion": "2:10.2.154.15-1.18.12.1.1.amzn2023.0.2",
      "fix": "ALAS2023-2023-084",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-084",
      "released": "2023-02-17T20:47:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}