Security advisory
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-32223
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 22:59 UTC · Revision 1
Source evidence
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.
osv:CVE-2022-32223
Complete source record
{
"id": "362b27df50d826aa642098935e233328ac24f7fa90c7f75c84692c58d9b7e2db",
"url": "https://osv.dev/vulnerability/CVE-2022-32223",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2022-32223",
"summary": "Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.",
"evidence": "osv:CVE-2022-32223",
"products": [],
"severity": "unknown",
"structured": {
"id": "CVE-2022-32223",
"aliases": [
"BIT-node-2022-32223",
"BIT-node-min-2022-32223",
"CVE-2022-32223"
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nodejs/node",
"type": "GIT",
"events": [
{
"introduced": "73aa21658dfa6a22c06451d080152b32b1f98dbe"
},
{
"last_affected": "354b6a93bd1d66f1833489d6fe01a2b0e8f6aff9"
},
{
"introduced": "354b6a93bd1d66f1833489d6fe01a2b0e8f6aff9"
},
{
"fixed": "50871b58d79c2493df7ed594d543df8a4162f4a4"
},
{
"introduced": "7162e686b18d22b4385fa5c04274fb04dbd810c7"
},
{
"last_affected": "49415500bb1bf51a1fade5ea2d03f3988ecabc25"
},
{
"introduced": "40ecd5601193c316e62e9216e8a4259130686208"
},
{
"fixed": "c98901f00d4b31a9a4b14d161177a7d9a64e36f7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "14.0.0"
},
{
"last_affected": "14.14.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
"range": [
{
"introduced": "14.14.0"
},
{
"fixed": "14.20.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "16.0.0"
},
{
"last_affected": "16.12.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
"range": [
{
"introduced": "16.13.0"
},
{
"fixed": "16.16.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v16.15.1",
"v16.15.0",
"v16.14.2",
"v16.14.1",
"v16.14.0",
"v16.13.2",
"v16.13.1",
"v16.13.0",
"v16.12.0",
"v16.11.1",
"v16.11.0",
"v16.10.0",
"v16.9.1",
"v16.9.0",
"v16.8.0",
"v16.7.0",
"v16.6.2",
"v16.6.1",
"v16.6.0",
"v16.5.0",
"v16.4.2",
"v16.4.1",
"v16.4.0",
"v16.3.0",
"v16.2.0",
"v16.1.0",
"v16.0.0",
"v14.14.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-32223.json"
}
}
],
"modified": "2026-10-28T02:30:24.134795900Z",
"provider": "osv",
"references": [
"https://hackerone.com/reports/1447455",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32223.json",
"https://nvd.nist.gov/vuln/detail/CVE-2022-32223",
"https://security.netapp.com/advisory/ntap-20220915-0001/",
"https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-427"
],
"cna_assigner": "hackerone",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "4.0"
},
{
"fixed": "4.*"
},
{
"introduced": "5.0"
},
{
"fixed": "5.*"
},
{
"introduced": "6.0"
},
{
"fixed": "6.*"
},
{
"introduced": "7.0"
},
{
"fixed": "7.*"
},
{
"introduced": "8.0"
},
{
"fixed": "8.*"
},
{
"introduced": "9.0"
},
{
"fixed": "9.*"
},
{
"introduced": "10.0"
},
{
"fixed": "10.*"
},
{
"introduced": "11.0"
},
{
"fixed": "11.*"
},
{
"introduced": "12.0"
},
{
"fixed": "12.*"
},
{
"introduced": "13.0"
},
{
"fixed": "13.*"
},
{
"introduced": "14.0"
},
{
"fixed": "14.20.0"
},
{
"introduced": "15.0"
},
{
"fixed": "15.*"
},
{
"introduced": "16.0"
},
{
"fixed": "16.20.0"
},
{
"introduced": "17.0"
},
{
"fixed": "17.*"
},
{
"introduced": "18.0"
},
{
"fixed": "18.5.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32223.json"
}
},
"related_cves": [
{
"value": "CVE-2022-32223",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 490694,
"published_at": "2022-07-14T14:51:18+00:00"
}