{ "document": { "aggregate_severity": { "text": "High" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_nodejs/alpinelinux3.24/vex/2018/cve-2018-7160-els_alt_nodejs-alpinelinux3_24.json" } ], "tracking": { "current_release_date": "2026-07-31T12:46:40Z", "generator": { "date": "2026-07-31T12:46:40Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2018-7160-ELS_ALT_NODEJS-ALPINELINUX3.24", "initial_release_date": "2018-05-17T14:29:00Z", "revision_history": [ { "date": "2018-05-17T14:29:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-07-28T12:26:06Z", "number": "2", "summary": "Official Publication" }, { "date": "2026-07-29T08:27:15Z", "number": "3", "summary": "Update document" }, { "date": "2026-07-31T12:46:40Z", "number": "4", "summary": "Update document" } ], "status": "final", "version": "4" }, "title": "Security update on CVE-2018-7160" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Alpine Linux 3.24", "product": { "name": "Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24", "product_identification_helper": { "cpe": "cpe:2.3:o:alpinelinux:alpine_linux:3.24:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Alpine Linux" } ], "category": "vendor", "name": "Alpine Linux" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-nodejs18-dev-18.20.8-r14.aarch64", "product": { "name": "alt-nodejs18-dev-18.20.8-r14.aarch64", "product_id": "alt-nodejs18-dev-18.20.8-r14.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-dev@18.20.8-r14?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-18.20.8-r14.aarch64", "product": { "name": "alt-nodejs18-18.20.8-r14.aarch64", "product_id": "alt-nodejs18-18.20.8-r14.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18@18.20.8-r14?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-doc-18.20.8-r14.aarch64", "product": { "name": "alt-nodejs18-doc-18.20.8-r14.aarch64", "product_id": "alt-nodejs18-doc-18.20.8-r14.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-doc@18.20.8-r14?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-18.20.8-r14.aarch64", "product": { "name": "alt-nodejs18-npm-18.20.8-r14.aarch64", "product_id": "alt-nodejs18-npm-18.20.8-r14.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-npm@18.20.8-r14?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-doc-14.21.3-r25.aarch64", "product": { "name": "alt-nodejs14-doc-14.21.3-r25.aarch64", "product_id": "alt-nodejs14-doc-14.21.3-r25.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14-doc@14.21.3-r25?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-dev-14.21.3-r25.aarch64", "product": { "name": "alt-nodejs14-dev-14.21.3-r25.aarch64", "product_id": "alt-nodejs14-dev-14.21.3-r25.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14-dev@14.21.3-r25?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-npm-14.21.3-r25.aarch64", "product": { "name": "alt-nodejs14-npm-14.21.3-r25.aarch64", "product_id": "alt-nodejs14-npm-14.21.3-r25.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14-npm@14.21.3-r25?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-14.21.3-r25.aarch64", "product": { "name": "alt-nodejs14-14.21.3-r25.aarch64", "product_id": "alt-nodejs14-14.21.3-r25.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14@14.21.3-r25?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-doc-23.11.1-r15.aarch64", "product": { "name": "alt-nodejs23-doc-23.11.1-r15.aarch64", "product_id": "alt-nodejs23-doc-23.11.1-r15.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23-doc@23.11.1-r15?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-dev-23.11.1-r15.aarch64", "product": { "name": "alt-nodejs23-dev-23.11.1-r15.aarch64", "product_id": "alt-nodejs23-dev-23.11.1-r15.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23-dev@23.11.1-r15?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-23.11.1-r15.aarch64", "product": { "name": "alt-nodejs23-23.11.1-r15.aarch64", "product_id": "alt-nodejs23-23.11.1-r15.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23@23.11.1-r15?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-npm-23.11.1-r15.aarch64", "product": { "name": "alt-nodejs23-npm-23.11.1-r15.aarch64", "product_id": "alt-nodejs23-npm-23.11.1-r15.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23-npm@23.11.1-r15?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-dev-16.20.2-r20.aarch64", "product": { "name": "alt-nodejs16-dev-16.20.2-r20.aarch64", "product_id": "alt-nodejs16-dev-16.20.2-r20.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16-dev@16.20.2-r20?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-16.20.2-r20.aarch64", "product": { "name": "alt-nodejs16-16.20.2-r20.aarch64", "product_id": "alt-nodejs16-16.20.2-r20.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16@16.20.2-r20?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-npm-16.20.2-r20.aarch64", "product": { "name": "alt-nodejs16-npm-16.20.2-r20.aarch64", "product_id": "alt-nodejs16-npm-16.20.2-r20.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16-npm@16.20.2-r20?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-doc-16.20.2-r20.aarch64", "product": { "name": "alt-nodejs16-doc-16.20.2-r20.aarch64", "product_id": "alt-nodejs16-doc-16.20.2-r20.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16-doc@16.20.2-r20?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-18.20.8-r17.aarch64", "product": { "name": "alt-nodejs18-npm-18.20.8-r17.aarch64", "product_id": "alt-nodejs18-npm-18.20.8-r17.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-npm@18.20.8-r17?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-dev-18.20.8-r17.aarch64", "product": { "name": "alt-nodejs18-dev-18.20.8-r17.aarch64", "product_id": "alt-nodejs18-dev-18.20.8-r17.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-dev@18.20.8-r17?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-doc-18.20.8-r17.aarch64", "product": { "name": "alt-nodejs18-doc-18.20.8-r17.aarch64", "product_id": "alt-nodejs18-doc-18.20.8-r17.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-doc@18.20.8-r17?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-18.20.8-r17.aarch64", "product": { "name": "alt-nodejs18-18.20.8-r17.aarch64", "product_id": "alt-nodejs18-18.20.8-r17.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18@18.20.8-r17?arch=aarch64&os_name=alpine&os_version=3.24" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "alt-nodejs18-dev-18.20.8-r14.x86_64", "product": { "name": "alt-nodejs18-dev-18.20.8-r14.x86_64", "product_id": "alt-nodejs18-dev-18.20.8-r14.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-dev@18.20.8-r14?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-18.20.8-r14.x86_64", "product": { "name": "alt-nodejs18-18.20.8-r14.x86_64", "product_id": "alt-nodejs18-18.20.8-r14.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18@18.20.8-r14?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-doc-18.20.8-r14.x86_64", "product": { "name": "alt-nodejs18-doc-18.20.8-r14.x86_64", "product_id": "alt-nodejs18-doc-18.20.8-r14.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-doc@18.20.8-r14?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-18.20.8-r14.x86_64", "product": { "name": "alt-nodejs18-npm-18.20.8-r14.x86_64", "product_id": "alt-nodejs18-npm-18.20.8-r14.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-npm@18.20.8-r14?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-doc-14.21.3-r25.x86_64", "product": { "name": "alt-nodejs14-doc-14.21.3-r25.x86_64", "product_id": "alt-nodejs14-doc-14.21.3-r25.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14-doc@14.21.3-r25?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-dev-14.21.3-r25.x86_64", "product": { "name": "alt-nodejs14-dev-14.21.3-r25.x86_64", "product_id": "alt-nodejs14-dev-14.21.3-r25.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14-dev@14.21.3-r25?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-npm-14.21.3-r25.x86_64", "product": { "name": "alt-nodejs14-npm-14.21.3-r25.x86_64", "product_id": "alt-nodejs14-npm-14.21.3-r25.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14-npm@14.21.3-r25?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-14.21.3-r25.x86_64", "product": { "name": "alt-nodejs14-14.21.3-r25.x86_64", "product_id": "alt-nodejs14-14.21.3-r25.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14@14.21.3-r25?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-doc-23.11.1-r15.x86_64", "product": { "name": "alt-nodejs23-doc-23.11.1-r15.x86_64", "product_id": "alt-nodejs23-doc-23.11.1-r15.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23-doc@23.11.1-r15?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-dev-23.11.1-r15.x86_64", "product": { "name": "alt-nodejs23-dev-23.11.1-r15.x86_64", "product_id": "alt-nodejs23-dev-23.11.1-r15.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23-dev@23.11.1-r15?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-23.11.1-r15.x86_64", "product": { "name": "alt-nodejs23-23.11.1-r15.x86_64", "product_id": "alt-nodejs23-23.11.1-r15.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23@23.11.1-r15?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-npm-23.11.1-r15.x86_64", "product": { "name": "alt-nodejs23-npm-23.11.1-r15.x86_64", "product_id": "alt-nodejs23-npm-23.11.1-r15.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23-npm@23.11.1-r15?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-dev-16.20.2-r20.x86_64", "product": { "name": "alt-nodejs16-dev-16.20.2-r20.x86_64", "product_id": "alt-nodejs16-dev-16.20.2-r20.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16-dev@16.20.2-r20?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-16.20.2-r20.x86_64", "product": { "name": "alt-nodejs16-16.20.2-r20.x86_64", "product_id": "alt-nodejs16-16.20.2-r20.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16@16.20.2-r20?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-npm-16.20.2-r20.x86_64", "product": { "name": "alt-nodejs16-npm-16.20.2-r20.x86_64", "product_id": "alt-nodejs16-npm-16.20.2-r20.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16-npm@16.20.2-r20?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-doc-16.20.2-r20.x86_64", "product": { "name": "alt-nodejs16-doc-16.20.2-r20.x86_64", "product_id": "alt-nodejs16-doc-16.20.2-r20.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16-doc@16.20.2-r20?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-18.20.8-r17.x86_64", "product": { "name": "alt-nodejs18-npm-18.20.8-r17.x86_64", "product_id": "alt-nodejs18-npm-18.20.8-r17.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-npm@18.20.8-r17?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-dev-18.20.8-r17.x86_64", "product": { "name": "alt-nodejs18-dev-18.20.8-r17.x86_64", "product_id": "alt-nodejs18-dev-18.20.8-r17.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-dev@18.20.8-r17?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-doc-18.20.8-r17.x86_64", "product": { "name": "alt-nodejs18-doc-18.20.8-r17.x86_64", "product_id": "alt-nodejs18-doc-18.20.8-r17.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-doc@18.20.8-r17?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-18.20.8-r17.x86_64", "product": { "name": "alt-nodejs18-18.20.8-r17.x86_64", "product_id": "alt-nodejs18-18.20.8-r17.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18@18.20.8-r17?arch=x86_64&os_name=alpine&os_version=3.24" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-dev-18.20.8-r14.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.aarch64" }, "product_reference": "alt-nodejs18-dev-18.20.8-r14.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-dev-18.20.8-r14.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.x86_64" }, "product_reference": "alt-nodejs18-dev-18.20.8-r14.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-18.20.8-r14.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.aarch64" }, "product_reference": "alt-nodejs18-18.20.8-r14.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-18.20.8-r14.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.x86_64" }, "product_reference": "alt-nodejs18-18.20.8-r14.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-doc-18.20.8-r14.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.x86_64" }, "product_reference": "alt-nodejs18-doc-18.20.8-r14.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-doc-18.20.8-r14.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.aarch64" }, "product_reference": "alt-nodejs18-doc-18.20.8-r14.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-18.20.8-r14.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.aarch64" }, "product_reference": "alt-nodejs18-npm-18.20.8-r14.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-18.20.8-r14.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.x86_64" }, "product_reference": "alt-nodejs18-npm-18.20.8-r14.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-doc-14.21.3-r25.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.aarch64" }, "product_reference": "alt-nodejs14-doc-14.21.3-r25.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-doc-14.21.3-r25.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.x86_64" }, "product_reference": "alt-nodejs14-doc-14.21.3-r25.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-dev-14.21.3-r25.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.x86_64" }, "product_reference": "alt-nodejs14-dev-14.21.3-r25.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-dev-14.21.3-r25.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.aarch64" }, "product_reference": "alt-nodejs14-dev-14.21.3-r25.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-npm-14.21.3-r25.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.aarch64" }, "product_reference": "alt-nodejs14-npm-14.21.3-r25.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-npm-14.21.3-r25.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.x86_64" }, "product_reference": "alt-nodejs14-npm-14.21.3-r25.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-14.21.3-r25.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.x86_64" }, "product_reference": "alt-nodejs14-14.21.3-r25.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-14.21.3-r25.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.aarch64" }, "product_reference": "alt-nodejs14-14.21.3-r25.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-doc-23.11.1-r15.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.aarch64" }, "product_reference": "alt-nodejs23-doc-23.11.1-r15.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-doc-23.11.1-r15.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.x86_64" }, "product_reference": "alt-nodejs23-doc-23.11.1-r15.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-dev-23.11.1-r15.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.x86_64" }, "product_reference": "alt-nodejs23-dev-23.11.1-r15.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-dev-23.11.1-r15.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.aarch64" }, "product_reference": "alt-nodejs23-dev-23.11.1-r15.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-23.11.1-r15.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.x86_64" }, "product_reference": "alt-nodejs23-23.11.1-r15.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-23.11.1-r15.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.aarch64" }, "product_reference": "alt-nodejs23-23.11.1-r15.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-npm-23.11.1-r15.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.aarch64" }, "product_reference": "alt-nodejs23-npm-23.11.1-r15.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-npm-23.11.1-r15.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.x86_64" }, "product_reference": "alt-nodejs23-npm-23.11.1-r15.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-dev-16.20.2-r20.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.aarch64" }, "product_reference": "alt-nodejs16-dev-16.20.2-r20.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-dev-16.20.2-r20.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.x86_64" }, "product_reference": "alt-nodejs16-dev-16.20.2-r20.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-16.20.2-r20.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.aarch64" }, "product_reference": "alt-nodejs16-16.20.2-r20.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-16.20.2-r20.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.x86_64" }, "product_reference": "alt-nodejs16-16.20.2-r20.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-npm-16.20.2-r20.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.aarch64" }, "product_reference": "alt-nodejs16-npm-16.20.2-r20.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-npm-16.20.2-r20.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.x86_64" }, "product_reference": "alt-nodejs16-npm-16.20.2-r20.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-doc-16.20.2-r20.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.x86_64" }, "product_reference": "alt-nodejs16-doc-16.20.2-r20.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-doc-16.20.2-r20.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.aarch64" }, "product_reference": "alt-nodejs16-doc-16.20.2-r20.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-18.20.8-r17.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.x86_64" }, "product_reference": "alt-nodejs18-npm-18.20.8-r17.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-18.20.8-r17.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.aarch64" }, "product_reference": "alt-nodejs18-npm-18.20.8-r17.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-dev-18.20.8-r17.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.aarch64" }, "product_reference": "alt-nodejs18-dev-18.20.8-r17.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-dev-18.20.8-r17.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.x86_64" }, "product_reference": "alt-nodejs18-dev-18.20.8-r17.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-doc-18.20.8-r17.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.aarch64" }, "product_reference": "alt-nodejs18-doc-18.20.8-r17.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-doc-18.20.8-r17.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.x86_64" }, "product_reference": "alt-nodejs18-doc-18.20.8-r17.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-18.20.8-r17.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.x86_64" }, "product_reference": "alt-nodejs18-18.20.8-r17.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-18.20.8-r17.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.aarch64" }, "product_reference": "alt-nodejs18-18.20.8-r17.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-7160", "cwe": { "id": "CWE-350", "name": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, "notes": [ { "category": "description", "text": "The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "other", "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.", "title": "Statement" } ], "product_status": { "known_not_affected": [ "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-lang/cve/CVE-2018-7160" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/" }, { "category": "external", "summary": "https://support.f5.com/csp/article/K63025104?utm_source=f5support&%3Butm_medium=RSS", "url": "https://support.f5.com/csp/article/K63025104?utm_source=f5support&%3Butm_medium=RSS" }, { "category": "external", "summary": "https://www.oracle.com//security-alerts/cpujul2021.html", "url": "https://www.oracle.com//security-alerts/cpujul2021.html" } ], "release_date": "2018-05-17T14:29:00Z", "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" }, { "category": "impact", "date": "2026-07-29T07:48:03.070207Z", "details": "Already fixed\n\nalt-nodejs18 18.20.8: ALREADY FIXED — fix-present: `IsAllowedHost` at `src/inspector_socket.cc:635` wired into the HTTP-event dispatch at `:548`, with the fix's regression tests present.\n\nPlatform in scope: alpinelinux3.24 (alt-nodejs18 18.20.8). No sibling precedent existed for this CVE at this version anywhere in ELSLANG; assessed from the shipped source and build configuration of alt-nodejs18, not from NVD version ranges.\n\nEvidence\n### Vulnerable component and where it lives\n- Flaw is in **Node.js's own code**, `src/inspector_socket.cc` (inspector/debug protocol HTTP+WebSocket handshake). **Not transitive** — no dependency carries it; this package ships the vulnerable-and-fixed file itself.\n- Inspector **is shipped and enabled** in all four packages: no `--without-inspector` in any APKBUILD. So the verdict is fix-present, not vulnerable-component-absent.\n\n### Upstream fix\n- Fix commit: [nodejs/node@bb0aabf3a5a2c37175aeb76e3aad9e0d0ecba4a1](https://github.com/nodejs/node/commit/bb0aabf3a5a2c37175aeb76e3aad9e0d0ecba4a1) — \"inspector: check Host header for local connections\" (Eugene Ostroukhov, authored 2018-03-20, committed 2018-03-28; private PR nodejs-private/node-private#102). Touches `src/inspector_socket.cc` and `test/cctest/test_inspector_socket.cc`.\n- First releases containing it: **v6.14.0, v8.11.0, v9.10.0** (2018-03-28 security releases). Node 4.x was never vulnerable (no inspector). Source: [Node.js March 2018 Security Releases](https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/).\n- Later hardening of the same code path, also present in all four trees (stricter than the original fix): [nodejs/node@10d9efe9650d](https://github.com/nodejs/node/commit/10d9efe9650d) \"src: drop localhost6 as allowed host for inspector\" (2021-02-23, CVE-2021-22884), which removed the 2018 helpers `IsOneOf`/`IsIPv4Localhost`; and the hardened `IsIPAddress()` (routable, unambiguously-formatted IP literals only — carries the in-tree `// TODO(tniessen): add CVEs` comment, CVE-2022-32212 family).\n\n### Fix code verified in each shipped tarball\nSymbols introduced by bb0aabf3, per `node-v.tar.gz` in each repo:\n\n| Symbol | 14.21.3 | 16.20.2 | 18.20.8 | 23.11.1 |\n|---|---|---|---|---|\n| `TrimPort()` | `src/inspector_socket.cc:155` | `:155` | `:156` | `:160` |\n| `IsIPAddress()` | `:165` | `:165` | `:166` | `:170` |\n| dispatch guard `if (!IsAllowedHost(event.host) \\|\\| !event.isGET)` | `:548` | `:548` | `:548` | `:552` |\n| `HeaderValue()` (generic header lookup added by the fix) | `:620` | `:620` | `:620` | `:624` |", "product_ids": [ "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.x86_64" ] }, { "category": "impact", "date": "2026-07-29T07:47:56.035362Z", "details": "Already fixed\n\nalt-nodejs14 14.21.3: ALREADY FIXED — fix-present: the inspector `Host`-header allowlist added by upstream commit bb0aabf3 (first released 6.14.0/8.11.0/9.10.0) is verified in the shipped tree at `src/inspector_socket.cc:635` (`IsAllowedHost`) together with both CVE regression tests.\n\nPlatform in scope: alpinelinux3.24 (alt-nodejs14 14.21.3). No sibling precedent existed for this CVE at this version anywhere in ELSLANG; assessed from the shipped source and build configuration of alt-nodejs14, not from NVD version ranges.\n\nEvidence\n### Vulnerable component and where it lives\n- Flaw is in **Node.js's own code**, `src/inspector_socket.cc` (inspector/debug protocol HTTP+WebSocket handshake). **Not transitive** — no dependency carries it; this package ships the vulnerable-and-fixed file itself.\n- Inspector **is shipped and enabled** in all four packages: no `--without-inspector` in any APKBUILD. So the verdict is fix-present, not vulnerable-component-absent.\n\n### Upstream fix\n- Fix commit: [nodejs/node@bb0aabf3a5a2c37175aeb76e3aad9e0d0ecba4a1](https://github.com/nodejs/node/commit/bb0aabf3a5a2c37175aeb76e3aad9e0d0ecba4a1) — \"inspector: check Host header for local connections\" (Eugene Ostroukhov, authored 2018-03-20, committed 2018-03-28; private PR nodejs-private/node-private#102). Touches `src/inspector_socket.cc` and `test/cctest/test_inspector_socket.cc`.\n- First releases containing it: **v6.14.0, v8.11.0, v9.10.0** (2018-03-28 security releases). Node 4.x was never vulnerable (no inspector). Source: [Node.js March 2018 Security Releases](https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/).\n- Later hardening of the same code path, also present in all four trees (stricter than the original fix): [nodejs/node@10d9efe9650d](https://github.com/nodejs/node/commit/10d9efe9650d) \"src: drop localhost6 as allowed host for inspector\" (2021-02-23, CVE-2021-22884), which removed the 2018 helpers `IsOneOf`/`IsIPv4Localhost`; and the hardened `IsIPAddress()` (routable, unambiguously-formatted IP literals only — carries the in-tree `// TODO(tniessen): add CVEs` comment, CVE-2022-32212 family).\n\n### Fix code verified in each shipped tarball\nSymbols introduced by bb0aabf3, per `node-v.tar.gz` in each repo:\n\n| Symbol | 14.21.3 | 16.20.2 | 18.20.8 | 23.11.1 |\n|---|---|---|---|---|\n| `TrimPort()` | `src/inspector_socket.cc:155` | `:155` | `:156` | `:160` |\n| `IsIPAddress()` | `:165` | `:165` | `:166` | `:170` |\n| dispatch guard `if (!IsAllowedHost(event.host) \\|\\| !event.isGET)` | `:548` | `:548` | `:548` | `:552` |\n| `HeaderValue()` (generic header lookup added by the fix) | `:620` | `:620` | `:620` | `:624` |", "product_ids": [ "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.x86_64" ] }, { "category": "impact", "date": "2026-07-29T07:47:54.688928Z", "details": "Already fixed\n\nalt-nodejs23 23.11.1: ALREADY FIXED — fix-present: `IsAllowedHost` at `src/inspector_socket.cc:639` wired into the dispatch at `:552`, carrying the later, stricter post-CVE-2021-22884 allowlist.\n\nPlatform in scope: alpinelinux3.24 (alt-nodejs23 23.11.1). No sibling precedent existed for this CVE at this version anywhere in ELSLANG; assessed from the shipped source and build configuration of alt-nodejs23, not from NVD version ranges.\n\nEvidence\n### Vulnerable component and where it lives\n- Flaw is in **Node.js's own code**, `src/inspector_socket.cc` (inspector/debug protocol HTTP+WebSocket handshake). **Not transitive** — no dependency carries it; this package ships the vulnerable-and-fixed file itself.\n- Inspector **is shipped and enabled** in all four packages: no `--without-inspector` in any APKBUILD. So the verdict is fix-present, not vulnerable-component-absent.\n\n### Upstream fix\n- Fix commit: [nodejs/node@bb0aabf3a5a2c37175aeb76e3aad9e0d0ecba4a1](https://github.com/nodejs/node/commit/bb0aabf3a5a2c37175aeb76e3aad9e0d0ecba4a1) — \"inspector: check Host header for local connections\" (Eugene Ostroukhov, authored 2018-03-20, committed 2018-03-28; private PR nodejs-private/node-private#102). Touches `src/inspector_socket.cc` and `test/cctest/test_inspector_socket.cc`.\n- First releases containing it: **v6.14.0, v8.11.0, v9.10.0** (2018-03-28 security releases). Node 4.x was never vulnerable (no inspector). Source: [Node.js March 2018 Security Releases](https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/).\n- Later hardening of the same code path, also present in all four trees (stricter than the original fix): [nodejs/node@10d9efe9650d](https://github.com/nodejs/node/commit/10d9efe9650d) \"src: drop localhost6 as allowed host for inspector\" (2021-02-23, CVE-2021-22884), which removed the 2018 helpers `IsOneOf`/`IsIPv4Localhost`; and the hardened `IsIPAddress()` (routable, unambiguously-formatted IP literals only — carries the in-tree `// TODO(tniessen): add CVEs` comment, CVE-2022-32212 family).\n\n### Fix code verified in each shipped tarball\nSymbols introduced by bb0aabf3, per `node-v.tar.gz` in each repo:\n\n| Symbol | 14.21.3 | 16.20.2 | 18.20.8 | 23.11.1 |\n|---|---|---|---|---|\n| `TrimPort()` | `src/inspector_socket.cc:155` | `:155` | `:156` | `:160` |\n| `IsIPAddress()` | `:165` | `:165` | `:166` | `:170` |\n| dispatch guard `if (!IsAllowedHost(event.host) \\|\\| !event.isGET)` | `:548` | `:548` | `:548` | `:552` |\n| `HeaderValue()` (generic header lookup added by the fix) | `:620` | `:620` | `:620` | `:624` |", "product_ids": [ "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.x86_64" ] }, { "category": "impact", "date": "2026-07-29T07:47:47.541756Z", "details": "Already fixed\n\nalt-nodejs16 16.20.2: ALREADY FIXED — fix-present: same `IsAllowedHost` gate and `HeaderValue(\"Host\")` capture verified at `src/inspector_socket.cc:635`/`:620`, plus `HostCheckedForGET`/`HostCheckedForUPGRADE` tests.\n\nPlatform in scope: alpinelinux3.24 (alt-nodejs16 16.20.2). No sibling precedent existed for this CVE at this version anywhere in ELSLANG; assessed from the shipped source and build configuration of alt-nodejs16, not from NVD version ranges.\n\nEvidence\n### Vulnerable component and where it lives\n- Flaw is in **Node.js's own code**, `src/inspector_socket.cc` (inspector/debug protocol HTTP+WebSocket handshake). **Not transitive** — no dependency carries it; this package ships the vulnerable-and-fixed file itself.\n- Inspector **is shipped and enabled** in all four packages: no `--without-inspector` in any APKBUILD. So the verdict is fix-present, not vulnerable-component-absent.\n\n### Upstream fix\n- Fix commit: [nodejs/node@bb0aabf3a5a2c37175aeb76e3aad9e0d0ecba4a1](https://github.com/nodejs/node/commit/bb0aabf3a5a2c37175aeb76e3aad9e0d0ecba4a1) — \"inspector: check Host header for local connections\" (Eugene Ostroukhov, authored 2018-03-20, committed 2018-03-28; private PR nodejs-private/node-private#102). Touches `src/inspector_socket.cc` and `test/cctest/test_inspector_socket.cc`.\n- First releases containing it: **v6.14.0, v8.11.0, v9.10.0** (2018-03-28 security releases). Node 4.x was never vulnerable (no inspector). Source: [Node.js March 2018 Security Releases](https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/).\n- Later hardening of the same code path, also present in all four trees (stricter than the original fix): [nodejs/node@10d9efe9650d](https://github.com/nodejs/node/commit/10d9efe9650d) \"src: drop localhost6 as allowed host for inspector\" (2021-02-23, CVE-2021-22884), which removed the 2018 helpers `IsOneOf`/`IsIPv4Localhost`; and the hardened `IsIPAddress()` (routable, unambiguously-formatted IP literals only — carries the in-tree `// TODO(tniessen): add CVEs` comment, CVE-2022-32212 family).\n\n### Fix code verified in each shipped tarball\nSymbols introduced by bb0aabf3, per `node-v.tar.gz` in each repo:\n\n| Symbol | 14.21.3 | 16.20.2 | 18.20.8 | 23.11.1 |\n|---|---|---|---|---|\n| `TrimPort()` | `src/inspector_socket.cc:155` | `:155` | `:156` | `:160` |\n| `IsIPAddress()` | `:165` | `:165` | `:166` | `:170` |\n| dispatch guard `if (!IsAllowedHost(event.host) \\|\\| !event.isGET)` | `:548` | `:548` | `:548` | `:552` |\n| `HeaderValue()` (generic header lookup added by the fix) | `:620` | `:620` | `:620` | `:624` |", "product_ids": [ "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.x86_64" ] } ] } ] }