{"id":"VND-nodejs-september-2022-security-releases","kind":"vulnerability","aliases":[],"related":["CVE-2018-7160","CVE-2022-32212","CVE-2022-32213","CVE-2022-32215","CVE-2022-32222","CVE-2022-35255","CVE-2022-35256"],"title":"Node.js: September 23rd 2022 Security Releases","description":"Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners September 23rd 2022 Security Releases VDT Vladimir de Turckheim September 23rd 2022 Security Releases (Update 26-September-2022) Security releases available\nRecommendation update regarding CVE-2022-35255: Roll-out and re-issue all keys generated with WebCrypto.subtle.generateKey() .\nRe-evaluate the confidentiality of data encrypted with those keys.\n(Update 23-September-2022) Security releases available\nUpdates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the\nfollowing issues.\nDNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices) (High) (CVE-2022-32212, CVE-2018-7160)\nThe fix for CVE-2022-32212, covered the cases for routable IP addresses, however, there exists a specific\nbehavior on macOS devices when handling the http://0.0.0.0 URL that allows an attacker-controlled DNS server to\nbypass the DNS rebinding protection by resolving hosts in the .local domain.\nAn attacker-controlled DNS server can, resolve &lt;Computer Name&gt;.local to any arbitrary IP address, and consequently\ncause the victim&#x27;s browser to load arbitrary content at http://0.0.0.0 .\nThis allows the attacker to bypass the DNS rebinding protection.\nThank you, to Zeyu Zhang (@zeyu2001) for reporting this vulnerability and thank you Rafael Gonzaga for fixing it.\nImpacts:\nAll versions of the 18.x, 16.x, and 14.x release lines.\nHTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding (Medium) (improper fix for CVE-2022-32215)\nDue to an incomplete fix for CVE-2022-32215, the llhttp parser in the http module in Node.js v16.16.0 and 18.7.0 still\ndoes not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).\nThank you, Liav Gutman of the JFrog CSO Team for reporting this vulnerability and thank you Paolo Insogna for fixing it.\nImpacts:\nAll versions of the 18.x, 16.x, and 14.x release lines.\nllhttp v6.0.10 contains the fixes that were updated inside Node.js\nCVE-2022-32213 bypass via obs-fold mechanic (Medium) (CVE-2022-32213)\nThe fix for CVE-2022-32213 can be bypassed using an obs-fold, which the Node.js HTTP parser supports.\nIf the Node.js HTTP module is used as a proxy, then it incorrectly parses the transfer-encoding header as indicative of\nchunked request, while folding the headers and hence forwarding Transfer-Encoding: chunked abc which is not a valid\ntransfer-encoding header to the downstream server. As such this can lead to HTTP request smuggling as indicated by\nCVE-2022-32213.\nThank you, Haxatron for reporting this vulnerability.\nImpacts:\nAll versions of the 18.x, 16.x, and 14.x release lines.\nllhttp v6.0.10 contains the fixes that were updated inside Node.js\nHTTP Request Smuggling Due to Incorrect Parsing of Header Fields (Medium) (CVE-2022-35256)\nThe llhttp parser in the http module in Node.js v18.7.0 does not correctly handle header fields that are not terminated\nwith CLRF. This may result in HTTP Request Smuggling.\nThank you, VVX7 for reporting this vulnerability.\nImpacts:\nAll versions of the 18.x, 16.x, and 14.x release lines.\nllhttp v6.0.10 contains the fixes that were updated inside Node.js\nNode 18 reads openssl.cnf from /home/iojs/build/... upon startup on macOS (Medium) (CVE-2022-32222)\nIn Node.js 18 and later, at startup, the process attempts to read\n/home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf on MacOS which ordinarily doesn&#x27;t exist.\nThe attack would be an attacker with access to a shared MacOS host with a self-chosen username (iojs) being able to\naffect the OpenSSF configuration of other users.\nThank you, Michael Dawson for reporting (and fixing!) this vulnerability.\nImpacts:\nAll versions of the 18.x releases lines.\nWeak randomness in WebCrypto keygen (High) (CVE-2022-35255)\nNode.js made calls to EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc .\nHowever, it does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail.\nThank you, Ben Noordhuis for reporting (and fixing!) this vulnerability.\nImpacts:\nAll versions of the 18.x and 16.x release lines.\nDownloads and release details\nThanks a lot Rafael Gonzaga, Ruy Adorno, Bryan English and Paolo Insogna for the release work.\nNode.js v14.20.1 (LTS)\nNode.js v16.17.1 (LTS)\nNode.js v18.9.1 (Current)\n(Update 22-September-2022) Security releases postponed\nSome fixes of the security releases have been recently updated and the Node.js security team still needs an extra day of work to ensure the binaries are ready to release.\nWe would like to thank you for your patience and understanding.\nThe releases are now planned for September 23rd 2022.\nSummary\nThe Node.js project will release new versions of the 14.x, 16.x, and 18.x\nreleases lines on or shortly after Thursday, September 22nd, 2022 in order to address:\nThree medium severity issues.\nOne high severity issues.\nImpact\nThe 18.x release line of Node.js is vulnerable to four medium severity issues and two high severity issues.\nThe 16.x release line of Node.js is vulnerable to three medium severity issues and two high severity issues.\nThe 14.x release line of Node.js is vulnerable to three medium severity issues and one high severity issue.\nRelease timing\nReleases will be available on, or shortly after, Thursday, September 22nd, 2022.\nContact and future updates\nThe current Node.js security policy can be found at /security/. Please follow the process outlined in https://github.com/nodejs/node/security/policy if you wish to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. Previous OpenSSL and ","summary":"Node.js 14, 16 and 18 release lines have several flaws, including a DNS rebinding bypass in --inspect on macOS, HTTP request smuggling in the llhttp parser, and WebCrypto key generation that does not check entropy failures. An attacker can reach internal services from a browser, smuggle requests past a proxy, or get predictable WebCrypto keys.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":["14.20.1"],"affected":">= 14.0.0, < 14.20.1","ecosystem":"node"},{"name":"node","fixed":["16.17.1"],"affected":">= 16.0.0, < 16.17.1","ecosystem":"node"},{"name":"node","fixed":["18.9.1"],"affected":">= 18.0.0, < 18.9.1","ecosystem":"node"}],"ecosystems":["node"],"tags":["macos","node","runtime","self-hosted","webcrypto"],"not_affected_if":["already-on-fixed-version","no-http-proxy-use","no-webcrypto-keygen"],"how_to_check":"- Run `node --version` and compare against the fixed versions `14.20.1`, `16.17.1` and `18.9.1`.\n- Check whether the app uses WebCrypto `subtle.generateKey()` on affected versions, since keys from those versions need re-issuing (CVE-2022-35255).\n- Check whether the Node HTTP module runs as a proxy in front of other servers, since that exposes the smuggling flaws.","fix":"- Node.js 14: upgrade to `14.20.1`.\n- Node.js 16: upgrade to `16.17.1`.\n- Node.js 18: upgrade to `18.9.1`.\n- Re-issue any keys generated with WebCrypto `subtle.generateKey()` on affected versions and re-evaluate data encrypted with them.","status":"open","published_at":"2022-09-15T16:00:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:41:48+00:00","updated_at":"2026-10-25T05:41:48+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:41:48Z","model":"claude-haiku-5-5","output":{"fix":"- Node.js 14: upgrade to `14.20.1`.\n- Node.js 16: upgrade to `16.17.1`.\n- Node.js 18: upgrade to `18.9.1`.\n- Re-issue any keys generated with WebCrypto `subtle.generateKey()` on affected versions and re-evaluate data encrypted with them.","reach":"network","title":"Node.js: September 2022 releases fix DNS rebinding, request smuggling and weak keygen","impact":"medium","summary":"Node.js 14, 16 and 18 release lines have several flaws, including a DNS rebinding bypass in --inspect on macOS, HTTP request smuggling in the llhttp parser, and WebCrypto key generation that does not check entropy failures. An attacker can reach internal services from a browser, smuggle requests past a proxy, or get predictable WebCrypto keys.","category":"runtime","nicknames":[],"who_cares":["node","self-hosted","macos","webcrypto"],"confidence":0.7,"needs_auth":"no","worst_case":"Requests smuggled past proxies, browsers reach local inspector, weak keys","analyst_note":"","how_to_check":"- Run `node --version` and compare against the fixed versions `14.20.1`, `16.17.1` and `18.9.1`.\n- Check whether the app uses WebCrypto `subtle.generateKey()` on affected versions, since keys from those versions need re-issuing (CVE-2022-35255).\n- Check whether the Node HTTP module runs as a proxy in front of other servers, since that exposes the smuggling flaws.","needs_analyst":false,"not_affected_if":["already-on-fixed-version","no-http-proxy-use","no-webcrypto-keygen"],"who_is_affected":"Teams running Node.js 14.x, 16.x or 18.x in any version below the fixed releases. The request smuggling and DNS rebinding issues matter most where Node serves as a proxy or where developers run --inspect on macOS; the WebCrypto issue matters where keys are generated with that API.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000944,"input_tokens":5678,"output_tokens":752,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2018':190C '-2022':115C,123C,151C,180C,187C,196C,330C,339C,419C,429C,435C,513C,558C,632C,710C '-32212':181C,188C,197C '-32213':420C,430C,436C,514C '-32215':331C,340C '-32222':633C '-35255':124C,711C '-35256':559C '-7160':191C '/home/iojs/build':625C '/home/iojs/build/ws/out/release/obj.target/deps/openssl/openssl.cnf':646C '0.0.0.0':217C,268C '14':26B,307C,404C,532C,606C '16':27B,304C,401C,529C,603C '18':29B,302C,399C,527C,601C,621C,636C,699C '18.7.0':352C '2022':4A,11A,100C,109C '23':149C '23rd':3A,99C,108C '26':113C 'abc':486C 'abl':675C 'access':661C 'address':204C,255C 'affect':182C,677C 'allow':220C,270C 'arbitrari':253C,265C 'attack':62B,223C,242C,272C,655C,659C 'attacker-control':222C,241C 'attempt':643C 'avail':90C,118C,154C,158C 'behavior':210C 'browser':69B,262C 'bypass':39B,228C,274C,421C,439C 'call':714C 'case':200C 'caus':258C 'check':58B 'chosen':671C 'chunk':473C,485C 'clrf':581C 'commerci':80C 'comput':248C 'confidenti':141C 'configur':680C 'consequ':257C 'contain':410C,538C,612C 'content':266C 'control':224C,243C 'correct':356C,572C 'cover':198C 'cso':380C 'cve':122C,179C,186C,189C,195C,329C,338C,418C,428C,434C,512C,557C,631C,709C 'data':143C 'dawson':687C 'de':105C 'devic':184C,213C 'dns':37B,172C,225C,230C,244C,276C 'doesn':651C 'dokeygen':719C 'domain':239C 'downstream':498C 'due':314C,332C,549C 'ecosystem':94C 'encod':324C,363C,468C,484C,494C 'encrypt':144C 'entropi':59B 'entropysourc':716C 'evalu':139C 'exist':207C,653C 'failur':60B 'field':555C,575C 'fix':177C,193C,295C,327C,336C,392C,412C,432C,540C,614C,691C 'flaw':34B 'fold':425C,444C,476C 'follow':170C 'forward':481C 'generat':54B,134C 'get':76B 'gonzaga':293C 'gutman':376C 'handl':215C,357C,573C 'haxatron':517C 'header':364C,469C,478C,495C,554C,574C 'henc':480C 'high':185C,708C 'host':23B,235C,666C 'howev':205C 'hrs':372C 'http':44B,311C,346C,369C,448C,454C,506C,546C,565C,586C 'impact':297C,394C,522C,596C,694C 'improp':326C 'includ':35B 'incomplet':335C 'incorrect':316C,463C,551C 'indic':471C,510C 'insid':416C,544C,618C 'insogna':390C 'inspect':41B,175C 'insuffici':176C 'intern':65B 'ioj':673C 'ip':203C,254C 'issu':131C,171C 'jfrog':379C 'key':53B,79B,133C,147C 'keygen':707C 'later':638C 'lead':367C,504C 'liav':375C 'line':31B,167C,310C,321C,360C,407C,535C,609C,702C 'llhttp':49B,342C,408C,536C,561C,610C 'load':264C 'local':238C,250C 'lts':87C 'maco':18B,43B,183C,212C,629C,648C,665C 'made':713C 'mainten':86C 'may':583C 'mechan':426C 'medium':325C,427C,556C,630C 'michael':686C 'modul':347C,455C,566C 'multi':320C,359C 'multi-lin':319C,358C 'name':249C 'node':15A,16A,17A,19B,620C 'node.js':1A,25B,165C,349C,417C,447C,453C,545C,568C,619C,635C,712C 'nodejs':9A 'ob':424C,443C 'obs-fold':423C,442C 'openj':93C 'openssf':679C 'openssl.cnf':623C 'ordinarili':650C 'paolo':389C 'pars':317C,464C,552C 'parser':50B,343C,449C,562C 'partner':97C 'past':72B,84C 'phase':88C 'predict':77B 'process':642C 'program':96C 'protect':232C,278C 'proxi':74B,460C 'rafael':292C 'random':704C 're':130C,138C 're-evalu':137C 're-issu':129C 'reach':64B 'read':622C,645C 'rebind':38B,173C,231C,277C 'recommend':119C 'regard':121C 'releas':6A,30B,102C,111C,117C,153C,166C,309C,406C,534C,608C,701C 'releases':14A 'report':286C,383C,519C,593C,689C 'request':45B,71B,312C,370C,474C,507C,547C,587C 'resolv':234C,247C 'result':584C 'roll':126C 'roll-out':125C 'routabl':202C 'runtim':20B 'secretkeygentrait':718C 'secur':5A,101C,110C,116C,152C 'security':13A 'security-releases':12A 'self':22B,670C 'self-chosen':669C 'self-host':21B 'septemb':2A,98C,107C,114C,150C 'september':10A 'server':226C,245C,499C 'servic':66B 'sever':33B 'share':664C 'smuggl':46B,70B,313C,371C,508C,548C,588C 'specif':209C 'src':721C 'startup':627C,640C 'still':353C 'support':81C,450C 'sustain':95C 'team':381C 'termin':579C 'thank':279C,290C,373C,387C,515C,589C,684C 'transfer':323C,362C,467C,483C,493C 'transfer-encod':322C,361C,466C,482C,492C 'turckheim':106C 'updat':112C,120C,148C,155C,415C,543C,617C 'upon':626C 'url':218C 'use':440C,457C 'user':683C 'usernam':672C 'v14.x':164C 'v16.16.0':350C 'v16.x':162C 'v18.7.0':569C 'v18.x':161C 'v6.0.10':409C,537C,611C 'valid':491C 'vdt':103C 'version':83C,299C,396C,524C,598C,696C 'via':422C 'victim':260C 'vladimir':104C 'vnd':8A 'vnd-nodejs-september':7A 'vulner':288C,385C,521C,595C,693C 'vvx7':591C 'weak':703C 'webcrypto':24B,52B,78B,706C 'webcrypto.subtle.generatekey':136C 'would':656C 'x':303C,305C,308C,400C,402C,405C,528C,530C,533C,602C,604C,607C,700C 'zeyu':282C 'zeyu2001':284C 'zhang':283C","nicknames":[],"mitigations":[],"who_affected":"Teams running Node.js 14.x, 16.x or 18.x in any version below the fixed releases. The request smuggling and DNS rebinding issues matter most where Node serves as a proxy or where developers run --inspect on macOS; the WebCrypto issue matters where keys are generated with that API.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2022-09-15T16:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"september-2022-security-releases","url":"https://nodejs.org/en/blog/vulnerability/september-2022-security-releases","severity":"high","published_at":"2022-09-15T16:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T13:03:42+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}