onyx

onyx --cves cve-2022-43548

CVE-2022-43548

HIGHNode.js
score
<0.1
cvss
8.1
epss
14.5%
published
2022-12-05
kev added
—
first seen

Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 contain an OS command injection caused by an insufficient IsAllowedHost check that can be bypassed due to improper IP address validation, letting attackers perform rebinding attacks, exploit requires bypassing IP validation.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2022-12-05 — PublishedP2026-10-21 — Tracked by OnyxTscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 14.6%2026-09-23: epss 14.6%2026-09-24: epss 14.6%2026-09-25: epss 14.6%2026-09-26: epss 14.6%2026-09-27: epss 14.6%2026-09-28: epss 14.6%2026-09-29: epss 14.6%2026-09-30: epss 14.6%2026-10-01: epss 14.6%2026-10-02: epss 14.6%2026-10-03: epss 14.6%2026-10-04: epss 14.6%2026-10-05: epss 14.5%2026-10-06: epss 14.5%2026-10-07: epss 14.5%2026-10-08: epss 14.5%2026-10-09: epss 14.5%2026-10-10: epss 14.5%2026-10-11: epss 14.5%2026-10-12: epss 14.5%2026-10-13: epss 14.5%2026-10-14: epss 14.5%2026-10-15: epss 14.5%2026-10-16: epss 14.5%2026-10-18: epss 14.5%2026-10-19: epss 14.5%2026-10-20: epss 14.5%2026-10-21: epss 14.5%14.5%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx

Weaknesses

CWE-78

References 5