CVE-2022-32212 | BDVDB-2026-180146 Detail

Description#

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12022-07-14Record published in the CVE List.
2. Version 22025-04-30Most recent update recorded in the CVE List.