September 23rd 2022 Security Releases
Node.js released security updates for the 18.x, 16.x, and 14.x release lines addressing DNS rebinding, HTTP request smuggling, and other vulnerabilities.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues.
Node.js
Node.js v14.20.1 (LTS)
- Affected versions
- All versions of the 18.x, 16.x, and 14.x release lines
Impacts: All versions of the 18.x, 16.x, and 14.x release lines.
- Fixed versions
- Node.js v14.20.1 (LTS)
Node.js v14.20.1 (LTS)
Node.js v16.17.1 (LTS)Node.js v16.17.1 (LTS)
Node.js v18.9.1 (Current)Node.js v18.9.1 (Current)
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2022-32212
DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)
CVE-2018-7160DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices) (High) (CVE-2022-32212, CVE-2018-7160)
CVE-2022-32213CVE-2022-32213 bypass via obs-fold mechanic (Medium) (CVE-2022-32213)
CVE-2022-35256HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium) (CVE-2022-35256)
CVE-2022-32222Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on macOS (Medium) (CVE-2022-32222)
CVE-2022-35255Weak randomness in WebCrypto keygen (High) (CVE-2022-35255)
Publisher severity
No explicit severity was extracted.