What’s Vulnerable › Vulnerabilities
CVE-2018-12123
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 4.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-11-28 · updated 2026-10-08
- Weakness: CWE-115
Description
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
Affected products
- Node.js: from 6.0.0 before 6.15.0; from 8.0.0 before 8.14.0; from 10.0.0 before 10.14.0; from 11.0.0 before 11.3.0 — fixed in 10.14.0, 11.3.0, 6.15.0, 8.14.0
How to fix
Upgrade to a fixed version: Node.js 10.14.0, 11.3.0, 6.15.0, 8.14.0. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2019:1821
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
- https://security.gentoo.org/glsa/202003-48
- https://access.redhat.com/errata/RHSA-2019:1821
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
- https://security.gentoo.org/glsa/202003-48
- https://security.netapp.com/advisory/ntap-20241213-0008/
Get alerted when CVE-2018-12123 or the next vulnerability affects your stack