OS Command Injection The advisory has been revoked - it doesn't affect any version of package nodejs (opens in a new tab)

Threat Intelligence

6.43% (94^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-ALPINE315-NODEJS-2953071
published19 Jul 2022
disclosed14 Jul 2022

Report a new vulnerability Found a mistake?

Introduced: 14 Jul 2022

CVE-2022-32212 (opens in a new tab) CWE-78 (opens in a new tab)

Amendment

The Alpine security team deemed this advisory irrelevant for Alpine:3.15.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs package and not the nodejs package as distributed by Alpine.

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.