CVE-2018-12123 - CVE House
Back to Database
Status published Medium CVE-2018-12123

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and...

Vulnerability Description

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-12123

Credits & Attribution

No credits recorded in the NVD database.

References

More from The Node.js Project

View All →
CVE-2018-7167
Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to...
High 7.5
CVE-2018-7166
In all versions of Node.js 10 prior to 10.9.0, an...
High 7.5
CVE-2018-7164
Node.js versions 9.7.0 and later and 10.x are vulnerable and...
High 7.5
CVE-2018-7162
All versions of Node.js 9.x and 10.x are vulnerable and...
High 7.5
CVE-2018-7161
All versions of Node.js 8.x, 9.x, and 10.x are vulnerable...
High 7.5

Affected Vendor

The Node.js Project

View all reports →

Affected Software

Node.js
Vulnerable Versions:
All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0

Timeline

Official Publish: November 28th, 2018
Last Modified: December 13th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-115

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.