p PatchFirst

CVE-2024-22020

CVE-2024-22020

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.

CVSS 6.5 · Medium · EPSS 1.1% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • node.js

    Versions
    • ≥ 4.0, < 4.*: Affected (semver)
    • ≥ 5.0, < 5.*: Affected (semver)
    • ≥ 6.0, < 6.*: Affected (semver)
    • ≥ 7.0, < 7.*: Affected (semver)
    • ≥ 8.0, < 8.*: Affected (semver)
    • ≥ 9.0, < 9.*: Affected (semver)
    • ≥ 10.0, < 10.*: Affected (semver)
    • ≥ 11.0, < 11.*: Affected (semver)
    • ≥ 12.0, < 12.*: Affected (semver)
    • ≥ 13.0, < 13.*: Affected (semver)
    • ≥ 14.0, < 14.*: Affected (semver)
    • ≥ 15.0, < 15.*: Affected (semver)
    • ≥ 16.0, < 16.*: Affected (semver)
    • ≥ 17.0, < 17.*: Affected (semver)
    • ≥ 18.0, < 18.20.4: Affected (semver)
    • ≥ 19.0, < 19.*: Affected (semver)
    • ≥ 20.0, < 20.15.1: Affected (semver)
    • ≥ 21.0, < 21.*: Affected (semver)
    • ≥ 22.0, < 22.4.1: Affected (semver)

    Update to 18.20.4; Update to 20.15.1; Update to 22.4.1

  • nodejs Debian:12

    Versions
    • 18.13.0+dfsg1-1
    • 18.13.0+dfsg1-1.1
    • 18.19.0+dfsg-1
    • 18.19.0+dfsg-2
    • 18.19.0+dfsg-3
    • 18.19.0+dfsg-4
    • 18.19.0+dfsg-5
    • 18.19.0+dfsg-6
    • 18.19.0+dfsg-6~deb12u1
    • 18.19.0+dfsg-6~deb12u2
    • 18.19.1+dfsg-1
    • 18.19.1+dfsg-2
    • 18.19.1+dfsg-3
    • 18.19.1+dfsg-3.1
    • 18.19.1+dfsg-4
    • 18.19.1+dfsg-6
    • 18.20.1+dfsg-1
    • 18.20.1+dfsg-2
    • 18.20.1+dfsg-3
    • 18.20.1+dfsg-4
    Affected ranges
    • ECOSYSTEM: < 18.20.4+dfsg-1~deb12u1

    Update to 18.20.4+dfsg-1~deb12u1

  • nodejs Debian:13

    Affected ranges
    • ECOSYSTEM: < 20.15.1+dfsg-1

    Update to 20.15.1+dfsg-1

  • nodejs Debian:14

    Affected ranges
    • ECOSYSTEM: < 20.15.1+dfsg-1

    Update to 20.15.1+dfsg-1

  • nodejs Ubuntu:24.04:LTS

    Versions
    • 18.13.0+dfsg1-1ubuntu2
    • 18.19.1+dfsg-2ubuntu4
    • 18.19.1+dfsg-6ubuntu1
    • 18.19.1+dfsg-6ubuntu2
    • 18.19.1+dfsg-6ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →