{"id":"VND-nodejs-november-2022-security-releases","kind":"vulnerability","aliases":[],"related":["CVE-2022-3602","CVE-2022-3786","CVE-2022-43548"],"title":"Node.js: Nov 3 2022 Security Releases","description":"Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners Nov 3 2022 Security Releases JJA Juan José Arboleda Nov 3 2022 Security Releases (Update 04-November-2022) Security releases available\nUpdates are now available for v14,x, v16.x, v18.x and v19.x Node.js\nrelease lines for the following issues.\nX.509 Email Address 4-byte Buffer Overflow (High) (CVE-2022-3602)\nA buffer overrun can be triggered in X.509 certificate verification,\nspecifically in name constraint checking. Note that this occurs\nafter certificate chain signature verification and requires either a\nCA to have signed the malicious certificate or for the application to\ncontinue certificate verification despite failure to construct a path\nto a trusted issuer. An attacker can craft a malicious email address\nto overflow four attacker-controlled bytes on the stack. This buffer\noverflow could result in a crash (causing a denial of service) or\npotentially remote code execution.\nImpacts:\nAll versions of the v18.x and v19.x releases lines.\nX.509 Email Address Variable Length Buffer Overflow (High) (CVE-2022-3786)\nA buffer overrun can be triggered in X.509 certificate verification,\nspecifically in name constraint checking. Note that this occurs after\ncertificate chain signature verification and requires either a CA to\nhave signed a malicious certificate or for an application to continue\ncertificate verification despite failure to construct a path to a trusted\nissuer. An attacker can craft a malicious email address in a certificate\nto overflow an arbitrary number of bytes containing the . character\n(decimal 46) on the stack. This buffer overflow could result in a crash\n(causing a denial of service).\nIn a TLS client, this can be triggered by connecting to a malicious\nserver. In a TLS server, this can be triggered if the server requests\nclient authentication and a malicious client connects.\nOpenSSL versions 3.0.0 to 3.0.6 are vulnerable to this issue.\nImpacts:\nAll versions of the v18.x and v19.x releases lines.\nDNS rebinding in --inspect via invalid octal IP address (Medium) (CVE-2022-43548)\nThe Node.js rebinding protector for --inspect still allows invalid IP address,\nspecifically, the octal format. An example of an octal IP address is 1.09.0.0,\nthe 09 octet is invalid because 9 is not a number in the base 8 number system.\nBrowsers such as Firefox (tested on latest version m105) will still attempt to\nresolve this invalid octal address via DNS. When combined with an active\n--inspect session, such as when using VSCode, an attacker can perform DNS\nrebinding and execute arbitrary code\nThank you to @haxatron1 for reporting this vulnerability.\nImpacts:\nAll versions of the v14.x, v16.x, v18.x, and v19.x releases lines.\nDownloads and release details\nNode.js v14.21.1 (LTS)\nNode.js v16.18.1 (LTS)\nNode.js v18.12.1 (LTS)\nNode.js v19.0.1 (Current)\n(Update 03-Nov-2022) Security Release target November 4th\nIt&#x27;s taking us a bit longer than originally expected and the Node.js Security Releases\nwill be available on, or shortly after, Friday, November 4th, 2022.\nSummary\nThe Node.js project will release new versions of the 14.x, 16.x, 18.x, 19.x\nreleases lines on or shortly after Thursday, November 3, 2022 in order to address:\nOne medium severity issues.\nTwo high severity issues that affect OpenSSL as per secadv/20221101.txt\nThese security releases are driven by the OpenSSL security release as announced in OpenSSL November Security Release as well as an additional vulnerability that affects all supported release lines.\nImpact\nThe 19.x release line of Node.js is vulnerable to one medium severity issue and two high severity issues.\nThe 18.x release line of Node.js is vulnerable to one medium severity issue and two high severity issues.\nThe 16.x release line of Node.js is vulnerable to one medium severity issue.\nThe 14.x release line of Node.js is vulnerable to one medium severity issue.\nRelease timing\nReleases will be available on, or shortly after, Thursday, November 3rd, 2022.\nContact and future updates\nThe current Node.js security policy can be found at /security/. Please follow the process outlined in https://github.com/nodejs/node/security/policy if you wish to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. Previous OpenSSL 3.0.7 update assessment Next OpenSSL November Security Release","summary":"Node.js releases fix two high-severity X.509 email address buffer overflows in certificate name constraint checking, which can crash a process or possibly lead to remote code execution. A medium-severity DNS rebinding flaw in --inspect, triggered by an invalid octal IP address, can let an attacker run code when an inspect session is active.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":["14.21.1"],"affected":">= 14.0.0, < 14.21.1","ecosystem":"node"},{"name":"node","fixed":["16.18.1"],"affected":">= 16.0.0, < 16.18.1","ecosystem":"node"},{"name":"node","fixed":["18.12.1"],"affected":">= 18.0.0, < 18.12.1","ecosystem":"node"},{"name":"node","fixed":["19.0.1"],"affected":">= 19.0.0, < 19.0.1","ecosystem":"node"}],"ecosystems":["node"],"tags":["debugging","node","runtime","self-hosted","tls"],"not_affected_if":["default-config","no-inspect-flag"],"how_to_check":"- Run `node --version` and compare it with the fixed versions below.\n- Check whether the application runs with `--inspect` enabled, for example in a process list or startup script.\n- Check whether the application is a TLS client or server that trusts or accepts certificates from outside parties.","fix":"- Upgrade Node.js 14.x to `14.21.1`, 16.x to `16.18.1`, 18.x to `18.12.1`, or 19.x to `19.0.1`.\n- Avoid running with `--inspect` on machines reachable by untrusted browsers until upgraded.","status":"open","published_at":"2022-11-01T21:00:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:41:43+00:00","updated_at":"2026-10-25T05:41:43+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-25T05:41:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js 14.x to `14.21.1`, 16.x to `16.18.1`, 18.x to `18.12.1`, or 19.x to `19.0.1`.\n- Avoid running with `--inspect` on machines reachable by untrusted browsers until upgraded.","reach":"internet","title":"Node.js: X.509 certificate and --inspect flaws allow crashes or code execution","impact":"high","summary":"Node.js releases fix two high-severity X.509 email address buffer overflows in certificate name constraint checking, which can crash a process or possibly lead to remote code execution. A medium-severity DNS rebinding flaw in --inspect, triggered by an invalid octal IP address, can let an attacker run code when an inspect session is active.","category":"runtime","nicknames":[],"who_cares":["node","self-hosted","tls","debugging"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker crashes the process or possibly executes code remotely","analyst_note":"","how_to_check":"- Run `node --version` and compare it with the fixed versions below.\n- Check whether the application runs with `--inspect` enabled, for example in a process list or startup script.\n- Check whether the application is a TLS client or server that trusts or accepts certificates from outside parties.","needs_analyst":false,"not_affected_if":["default-config","no-inspect-flag"],"who_is_affected":"Any application running an affected Node.js release line is exposed to the X.509 overflows, and the TLS client and server paths are the most likely to see hostile certificates. The --inspect DNS rebinding issue only matters where the debugger is enabled and a browser on that machine visits attacker content. Systems on v18.x and v19.x are affected by both X.509 issues, and v14.x through v19.x are affected by the --inspect issue.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000833,"input_tokens":4985,"output_tokens":668,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2022':118C,149C,259C,417C,541C '-3602':150C '-3786':260C '-43548':418C '03':539C '04':116C '09':444C '1.09.0.0':442C '14':583C,702C '16':585C,688C '18':587C,669C '19':589C,650C '2022':4A,11A,103C,112C,572C,600C '3':3A,102C,111C,599C '3.0.0':388C '3.0.6':390C '4':143C '46':336C '4th':546C,571C '8':457C '9':449C 'activ':82B,484C 'addit':640C 'address':35B,70B,142C,211C,252C,321C,414C,429C,440C,477C,604C 'affect':614C,643C 'allow':426C 'announc':630C 'applic':189C,299C 'arbitrari':328C,500C 'arboleda':109C 'attack':74B,205C,216C,315C,493C 'attacker-control':215C 'attempt':471C 'authent':380C 'avail':93C,121C,125C,564C 'base':456C 'bit':552C 'browser':460C 'buffer':36B,145C,152C,223C,255C,262C,341C 'byte':144C,218C,331C 'ca':179C,289C 'caus':230C,348C 'certif':39B,159C,171C,185C,192C,269C,281C,295C,302C,324C 'chain':172C,282C 'charact':334C 'check':42B,165C,275C 'client':356C,379C,384C 'code':53B,76B,238C,501C 'combin':481C 'commerci':83C 'connect':362C,385C 'constraint':41B,164C,274C 'construct':197C,307C 'contain':332C 'continu':191C,301C 'control':217C 'could':225C,343C 'craft':207C,317C 'crash':45B,229C,347C 'current':537C 'cve':148C,258C,416C 'debug':19B 'decim':335C 'denial':232C,350C 'despit':194C,304C 'detail':525C 'dns':59B,406C,479C,496C 'download':522C 'driven':623C 'ecosystem':97C 'either':177C,287C 'email':34B,141C,210C,251C,320C 'exampl':435C 'execut':54B,239C,499C 'expect':556C 'failur':195C,305C 'firefox':463C 'fix':28B 'flaw':61B 'follow':138C 'format':433C 'four':214C 'friday':569C 'haxatron1':505C 'high':31B,147C,257C,610C,665C,684C 'high-sever':30B 'host':24B 'impact':240C,396C,510C,648C 'inspect':63B,79B,409C,424C,485C 'invalid':67B,411C,427C,447C,475C 'ip':69B,413C,428C,439C 'issu':139C,395C,608C,612C,662C,667C,681C,686C,700C,714C 'issuer':203C,313C 'jja':106C 'josé':108C 'juan':107C 'latest':466C 'lead':50B 'length':254C 'let':72B 'line':135C,249C,405C,521C,592C,647C,653C,672C,691C,705C 'longer':553C 'lts':90C,528C,531C,534C 'm105':468C 'mainten':89C 'malici':184C,209C,294C,319C,365C,383C 'medium':57B,415C,606C,660C,679C,698C,712C 'medium-sever':56B 'name':40B,163C,273C 'new':579C 'node':15A,16A,17A,18A,20B 'node.js':1A,26B,133C,420C,526C,529C,532C,535C,559C,575C,655C,674C,693C,707C 'nodejs':9A 'note':166C,276C 'nov':2A,101C,110C,540C 'novemb':117C,545C,570C,598C,633C 'november':10A 'number':329C,453C,458C 'occur':169C,279C 'octal':68B,412C,432C,438C,476C 'octet':445C 'one':605C,659C,678C,697C,711C 'openj':96C 'openssl':386C,615C,626C,632C 'order':602C 'origin':555C 'overflow':37B,146C,213C,224C,256C,326C,342C 'overrun':153C,263C 'partner':100C 'past':87C 'path':199C,309C 'per':617C 'perform':495C 'phase':91C 'possibl':49B 'potenti':236C 'process':47B 'program':99C 'project':576C 'protector':422C 'rebind':60B,407C,421C,497C 'releas':6A,27B,105C,114C,120C,134C,248C,404C,520C,524C,543C,561C,578C,591C,621C,628C,635C,646C,652C,671C,690C,704C,715C,717C 'releases':14A 'remot':52B,237C 'report':507C 'request':378C 'requir':176C,286C 'resolv':473C 'result':226C,344C 'run':75B 'runtim':21B 'secadv/20221101.txt':618C 'secur':5A,104C,113C,119C,542C,560C,620C,627C,634C 'security':13A 'security-releases':12A 'self':23B 'self-host':22B 'server':366C,370C,377C 'servic':234C,352C 'session':80B,486C 'sever':32B,58B,607C,611C,661C,666C,680C,685C,699C,713C 'short':567C,595C 'sign':182C,292C 'signatur':173C,283C 'specif':161C,271C,430C 'stack':221C,339C 'still':425C,470C 'summari':573C 'support':84C,645C 'sustain':98C 'system':459C 'take':549C 'target':544C 'test':464C 'thank':502C 'thursday':597C 'time':716C 'tls':25B,355C,369C 'trigger':64B,156C,266C,360C,374C 'trust':202C,312C 'two':29B,609C,664C,683C 'updat':115C,122C,538C 'us':550C 'use':490C 'v14':127C 'v14.21.1':527C 'v14.x':515C 'v16.18.1':530C 'v16.x':129C,516C 'v18.12.1':533C 'v18.x':130C,245C,401C,517C 'v19.0.1':536C 'v19.x':132C,247C,403C,519C 'variabl':253C 'verif':160C,174C,193C,270C,284C,303C 'version':86C,242C,387C,398C,467C,512C,580C 'via':410C,478C 'vnd':8A 'vnd-nodejs-november':7A 'vscode':491C 'vulner':392C,509C,641C,657C,676C,695C,709C 'well':637C 'x':128C,584C,586C,588C,590C,651C,670C,689C,703C 'x.509':33B,140C,158C,250C,268C","nicknames":[],"mitigations":[],"who_affected":"Any application running an affected Node.js release line is exposed to the X.509 overflows, and the TLS client and server paths are the most likely to see hostile certificates. The --inspect DNS rebinding issue only matters where the debugger is enabled and a browser on that machine visits attacker content. Systems on v18.x and v19.x are affected by both X.509 issues, and v14.x through v19.x are affected by the --inspect issue.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2022-11-01T21:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"november-2022-security-releases","url":"https://nodejs.org/en/blog/vulnerability/november-2022-security-releases","severity":"high","published_at":"2022-11-01T21:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-26T05:49:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}