Hostname Spoofing Vulnerability in Node.js by Node.js Foundation

CVE-2018-12123

What is CVE-2018-12123?

A vulnerability exists in Node.js's URL parser affecting multiple versions. This flaw allows a malicious user to spoof hostnames using mixed case 'javascript:' protocol calls, leading to potential misjudgment in security decisions based on these hostnames. Applications that rely on url.parse() may incorrectly interpret the URL due to this spoofing capability, posing security risks in environments where hostname fidelity is critical.

References