CVE-2024-22020
Fixed in a distro release EPSS 1%CVSS 6.5
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.
Products: NodeJS Node, nodejs
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs | 1:20.16.0-1.module_el8.10.0+3882+e12e42db |
| AlmaLinux 8 | nodejs | 1:18.20.4-1.module_el8.10.0+3890+5a092792 |
| AlmaLinux 8 | nodejs-devel | 1:20.16.0-1.module_el8.10.0+3882+e12e42db |
| AlmaLinux 8 | nodejs-devel | 1:18.20.4-1.module_el8.10.0+3890+5a092792 |
| AlmaLinux 8 | nodejs-docs | 1:18.20.4-1.module_el8.10.0+3890+5a092792 |
| AlmaLinux 8 | nodejs-docs | 1:20.16.0-1.module_el8.10.0+3882+e12e42db |
| AlmaLinux 8 | nodejs-full-i18n | 1:20.16.0-1.module_el8.10.0+3882+e12e42db |
| AlmaLinux 8 | nodejs-full-i18n | 1:18.20.4-1.module_el8.10.0+3890+5a092792 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3613+1ed8c91d |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3775+d8460d35 |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux 8 | npm | 1:10.8.1-1.20.16.0.1.module_el8.10.0+3882+e12e42db |
| AlmaLinux 8 | npm | 1:10.7.0-1.18.20.4.1.module_el8.10.0+3890+5a092792 |
| AlmaLinux 9 | nodejs | 1:18.20.4-1.module_el9.4.0+112+bb28ff81 |
| AlmaLinux 9 | nodejs | 1:20.16.0-1.module_el9.4.0+107+dbd477e4 |
| AlmaLinux 9 | nodejs-devel | 1:18.20.4-1.module_el9.4.0+112+bb28ff81 |
| AlmaLinux 9 | nodejs-devel | 1:20.16.0-1.module_el9.4.0+107+dbd477e4 |
| AlmaLinux 9 | nodejs-docs | 1:18.20.4-1.module_el9.4.0+112+bb28ff81 |
| AlmaLinux 9 | nodejs-docs | 1:20.16.0-1.module_el9.4.0+107+dbd477e4 |
| AlmaLinux 9 | nodejs-full-i18n | 1:20.16.0-1.module_el9.4.0+107+dbd477e4 |
| AlmaLinux 9 | nodejs-full-i18n | 1:18.20.4-1.module_el9.4.0+112+bb28ff81 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 |
| AlmaLinux 9 | nodejs-nodemon | 3.0.1-1.module_el9.2.0+36+853e48f5 |
| AlmaLinux 9 | nodejs-packaging | 2021.06-4.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-packaging | 2021.06-4.module_el9.1.0+13+d9a595ea |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+88+29afeaa2 |
| AlmaLinux 9 | nodejs-packaging-bundler | 2021.06-4.module_el9.1.0+13+d9a595ea |
| AlmaLinux 9 | npm | 1:10.8.1-1.20.16.0.1.module_el9.4.0+107+dbd477e4 |
| AlmaLinux 9 | npm | 1:10.7.0-1.18.20.4.1.module_el9.4.0+112+bb28ff81 |
| Alpine 3.19 | nodejs | 20.15.1-r0 |
| Alpine 3.20 | nodejs | 20.15.1-r0 |
| Alpine 3.21 | nodejs | 20.15.1-r0 |
| Alpine 3.22 | nodejs | 20.15.1-r0 |
| Alpine 3.23 | nodejs | 20.15.1-r0 |
| Alpine 3.24 | nodejs | 20.15.1-r0 |
| Chainguard | kibana-7.17 | 7.17.22-r0 |
| Chainguard | nodejs-16 | no fix |
| Chainguard | nodejs-18 | 18.20.4-r0 |
| Chainguard | nodejs-20 | 20.15.1-r0 |
| Chainguard | nodejs-21 | no fix |
| Chainguard | nodejs-22 | 22.4.1-r0 |
| Debian 12 | nodejs | 18.20.4+dfsg-1~deb12u1 |
| Debian 13 | nodejs | 20.15.1+dfsg-1 |
| Debian 14 | nodejs | 20.15.1+dfsg-1 |
| Red Hat Enterprise Linux 8 | nodejs | 1:20.16.0-1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 8 | nodejs | 1:18.20.4-1.module+el8.10.0+22199+56ea0ead |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:20.16.0-1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:18.20.4-1.module+el8.10.0+22199+56ea0ead |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:20.16.0-1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:18.20.4-1.module+el8.10.0+22199+56ea0ead |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:20.16.0-1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:18.20.4-1.module+el8.10.0+22199+56ea0ead |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:20.16.0-1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:18.20.4-1.module+el8.10.0+22199+56ea0ead |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:20.16.0-1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:18.20.4-1.module+el8.10.0+22199+56ea0ead |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+21159+f5a7145d |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.9.0+19439+7b18b275 |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.9.0+19439+7b18b275 |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | npm | 1:10.7.0-1.18.20.4.1.module+el8.10.0+22199+56ea0ead |
| Red Hat Enterprise Linux 8 | npm | 1:10.8.1-1.20.16.0.1.module+el8.10.0+22203+a88c8310 |
| Red Hat Enterprise Linux 9 | nodejs | 1:18.20.4-1.module+el9.4.0+22195+c221878e |
| Red Hat Enterprise Linux 9 | nodejs | 1:20.16.0-1.module+el9.4.0+22197+9e60f127 |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:18.20.4-1.module+el9.4.0+22195+c221878e |
| Red Hat Enterprise Linux 9 | nodejs-debuginfo | 1:20.16.0-1.module+el9.4.0+22197+9e60f127 |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:18.20.4-1.module+el9.4.0+22195+c221878e |
| Red Hat Enterprise Linux 9 | nodejs-debugsource | 1:20.16.0-1.module+el9.4.0+22197+9e60f127 |
| Red Hat Enterprise Linux 9 | nodejs-devel | 1:20.16.0-1.module+el9.4.0+22197+9e60f127 |
| Red Hat Enterprise Linux 9 | nodejs-devel | 1:18.20.4-1.module+el9.4.0+22195+c221878e |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:20.16.0-1.module+el9.4.0+22197+9e60f127 |
| Red Hat Enterprise Linux 9 | nodejs-docs | 1:18.20.4-1.module+el9.4.0+22195+c221878e |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:20.16.0-1.module+el9.4.0+22197+9e60f127 |
| Red Hat Enterprise Linux 9 | nodejs-full-i18n | 1:18.20.4-1.module+el9.4.0+22195+c221878e |
| Red Hat Enterprise Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781 |
| Red Hat Enterprise Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.3.0+19762+d716bf3b |
| Red Hat Enterprise Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.3.0+19518+63aad52d |
| Red Hat Enterprise Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.1.0+15718+e52ec601 |
| Red Hat Enterprise Linux 9 | nodejs-packaging-bundler | 0:2021.06-4.module+el9.1.0+15718+e52ec601 |
| Red Hat Enterprise Linux 9 | nodejs-packaging-bundler | 0:2021.06-4.module+el9.3.0+19518+63aad52d |
| Red Hat Enterprise Linux 9 | npm | 1:10.7.0-1.18.20.4.1.module+el9.4.0+22195+c221878e |
| Red Hat Enterprise Linux 9 | npm | 1:10.8.1-1.20.16.0.1.module+el9.4.0+22197+9e60f127 |
| Rocky Linux 8 | nodejs | 1:18.20.4-1.module+el8.10.0+1865+67d146ca |
| Rocky Linux 8 | nodejs | 1:20.16.0-1.module+el8.10.0+1856+4cdb8df5 |
| Rocky Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.10.0+1666+930e28e8 |
| Rocky Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.10.0+1667+4a788d89 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b |
| Rocky Linux 9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs18 | 18.20.4-8.24.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs18 | 18.20.4-150400.9.24.2 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP5 | nodejs20 | 20.15.1-150500.11.12.2 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP6 | nodejs20 | 20.15.1-150600.3.3.2 |
| Ubuntu 24.04 LTS | nodejs | no fix |
| Wolfi | nodejs-16 | no fix |
| Wolfi | nodejs-18 | 18.20.4-r0 |
| Wolfi | nodejs-20 | 20.15.1-r0 |
| Wolfi | nodejs-21 | no fix |
| Wolfi | nodejs-22 | 22.4.1-r0 |
| openSUSE Leap 15.5 | nodejs18 | 18.20.4-150400.9.24.2 |
| openSUSE Leap 15.5 | nodejs20 | 20.15.1-150500.11.12.2 |
| openSUSE Leap 15.6 | nodejs20 | 20.15.1-150600.3.3.2 |
| openSUSE Tumbleweed | nodejs20 | 20.15.1-1.1 |
| openSUSE Tumbleweed | nodejs22 | 22.10.0-1.1 |
| openSUSE Tumbleweed | nodejs24 | 24.11.1-2.1 |
| openSUSE Tumbleweed | nodejs26 | 26.3.1-1.1 |