What’s Vulnerable › Vulnerabilities

CVE-2022-36127: Service unavailability impact in NodeJS agent(version <= 0.5.0)

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-18 · updated 2026-06-17

Description

A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.

Affected products

• Apache Software Foundation Apache SkyWalking NodeJS Agent: before 0.5.1 — fixed in 0.5.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache SkyWalking NodeJS Agent 0.5.1. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2022/07/18/1
• https://lists.apache.org/thread/x238wo4r5goy39dxdjcmlofp6gcdnqr3
• http://www.openwall.com/lists/oss-security/2022/07/18/1
• https://lists.apache.org/thread/x238wo4r5goy39dxdjcmlofp6gcdnqr3

Get alerted when CVE-2022-36127 or the next vulnerability affects your stack