The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the nodejs-nodemon-2.0.19-1.el9 build changelog.

  - This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in     enclosure containing path separator. (CVE-2020-28469)

  - The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS     (regular expression denial of service) issue because it has exponential performance for data: URLs.
    (CVE-2021-33502)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2022:6595 advisory.

  - npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or     with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm     publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published     files into the npm registry they did not intend to include. Users should upgrade to the latest, patched     version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0     include the patched v8.11.0 version of npm. (CVE-2022-29244)

  - This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application     that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited     further depending on the context. (CVE-2020-7788)

  - This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in     enclosure containing path separator. (CVE-2020-28469)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS     (regular expression denial of service) issue because it has exponential performance for data: URLs.
    (CVE-2021-33502)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:6595 advisory.

  - This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application     that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited     further depending on the context. (CVE-2020-7788)

  - This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in     enclosure containing path separator. (CVE-2020-28469)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS     (regular expression denial of service) issue because it has exponential performance for data: URLs.
    (CVE-2021-33502)

  - npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or     with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm     publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published     files into the npm registry they did not intend to include. Users should upgrade to the latest, patched     version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0     include the patched v8.11.0 version of npm. (CVE-2022-29244)

  - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.16.0, <18.5.0 due to an     insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check     if an IP address is invalid before making DBS requests allowing rebinding attacks. (CVE-2022-32212)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse     and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). (CVE-2022-32213)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use     the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32214)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly     handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32215)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6985 advisory.

  - nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

  - nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

  - nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

  - nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

  - nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:6448 advisory.

  - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.16.0, <18.5.0 due to an     insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check     if an IP address is invalid before making DBS requests allowing rebinding attacks. (CVE-2022-32212)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse     and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). (CVE-2022-32213)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use     the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32214)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly     handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32215)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6595 advisory.

  - This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application     that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited     further depending on the context. (CVE-2020-7788)

  - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.16.0, <18.5.0 due to an     insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check     if an IP address is invalid before making DBS requests allowing rebinding attacks. (CVE-2022-32212)

  - The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-     Encoding headers and can lead to HTTP Request Smuggling (HRS). (CVE-2022-32213)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP     requests. This can lead to HTTP Request Smuggling (HRS). (CVE-2022-32214)

  - The llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line Transfer-     Encoding headers. This can lead to HTTP Request Smuggling (HRS). (CVE-2022-32215)

  - npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or     with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm     publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published     files into the npm registry they did not intend to include. Users should upgrade to the latest, patched     version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0     include the patched v8.11.0 version of npm. (CVE-2022-29244)

  - This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in     enclosure containing path separator. (CVE-2020-28469)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS     (regular expression denial of service) issue because it has exponential performance for data: URLs.
    (CVE-2021-33502)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6595 advisory.

  - nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

  - nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

  - nodejs-normalize-url: ReDoS for data URLs (CVE-2021-33502)

  - nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  - nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a     workspace (CVE-2022-29244)

  - nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

  - nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

  - nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

  - nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

  - nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6449 advisory.

  - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.16.0, <18.5.0 due to an     insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check     if an IP address is invalid before making DBS requests allowing rebinding attacks. (CVE-2022-32212)

  - The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-     Encoding headers and can lead to HTTP Request Smuggling (HRS). (CVE-2022-32213)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP     requests. This can lead to HTTP Request Smuggling (HRS). (CVE-2022-32214)

  - The llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line Transfer-     Encoding headers. This can lead to HTTP Request Smuggling (HRS). (CVE-2022-32215)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6448 advisory.

  - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.16.0, <18.5.0 due to an     insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check     if an IP address is invalid before making DBS requests allowing rebinding attacks. (CVE-2022-32212)

  - The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-     Encoding headers and can lead to HTTP Request Smuggling (HRS). (CVE-2022-32213)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP     requests. This can lead to HTTP Request Smuggling (HRS). (CVE-2022-32214)

  - The llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line Transfer-     Encoding headers. This can lead to HTTP Request Smuggling (HRS). (CVE-2022-32215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6448 advisory.

  - nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

  - nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

  - nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

  - nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

  - nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6449 advisory.

  - nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  - nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

  - nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

  - nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

  - nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

  - nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2022:6449 advisory.

  - nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  - nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

  - nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

  - nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

  - nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

  - nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2022:6448 advisory.

  - nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

  - nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

  - nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

  - nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

  - nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6389 advisory.

  - nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

  - nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

  - nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

  - nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

  - nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191419	CentOS 9 : nodejs-nodemon-2.0.19-1.el9	Nessus	CentOS Local Security Checks	medium
171017	Rocky Linux 9 : nodejs and nodejs-nodemon (RLSA-2022:6595)	Nessus	Rocky Linux Local Security Checks	critical
166249	AlmaLinux 9 : nodejs and nodejs-nodemon (ALSA-2022:6595)	Nessus	Alma Linux Local Security Checks	critical
166201	RHEL 8 : nodejs:14 (RHSA-2022:6985)	Nessus	Red Hat Local Security Checks	high
165814	AlmaLinux 8 : nodejs:14 (ALSA-2022:6448)	Nessus	Alma Linux Local Security Checks	high
165309	Oracle Linux 9 : nodejs / and / nodejs-nodemon (ELSA-2022-6595)	Nessus	Oracle Linux Local Security Checks	critical
165270	RHEL 9 : nodejs and nodejs-nodemon (RHSA-2022:6595)	Nessus	Red Hat Local Security Checks	critical
165169	Oracle Linux 8 : nodejs:16 (ELSA-2022-6449)	Nessus	Oracle Linux Local Security Checks	high
165167	Oracle Linux 8 : nodejs:14 (ELSA-2022-6448)	Nessus	Oracle Linux Local Security Checks	high
164960	RHEL 8 : nodejs:14 (RHSA-2022:6448)	Nessus	Red Hat Local Security Checks	high
164959	RHEL 8 : nodejs:16 (RHSA-2022:6449)	Nessus	Red Hat Local Security Checks	high
164955	CentOS 8 : nodejs:16 (CESA-2022:6449)	Nessus	CentOS Local Security Checks	high
164953	CentOS 8 : nodejs:14 (CESA-2022:6448)	Nessus	CentOS Local Security Checks	high
164842	RHEL 7 : rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon (RHSA-2022:6389)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2022-33987

medium

Tenable Plugins

medium

critical

critical

high

high

critical

critical

high

high

high

high

high

high

high