Node.js OS Command Injection Vulnerability Affecting Multiple Versions

CVE-2022-43548

What is CVE-2022-43548?

An OS Command Injection vulnerability exists in various Node.js versions, primarily stemming from an inadequate validation in the IsAllowedHost check. This flaw allows attackers to bypass validation checks for IP addresses, potentially leading to rebinding attacks that can compromise system security. Previous mitigations were incomplete, necessitating the issuance of this vulnerability notice to emphasize the need for updated security measures in affected Node.js versions.

References