CVE-2018-7160
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
The Node.js inspector in version 6.x and later is vulnerable to a DNS rebinding attack that could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer or another computer with network access to the machine running the Node.js process. A malicious website could use DNS rebinding to bypass same-origin-policy checks and allow HTTP connections to localhost or local network hosts. If a Node.js process with the debug port active is running on localhost or a local network host, the malicious website could connect to it as a debugger and gain full code execution access.
Risk Assessment
Full control over the Node.js process, potentially leading to remote code execution and system compromise.
Recommendation
Update Node.js to a version that includes a fix for this vulnerability and do not run processes with the debug port active in production environments.
Other vulnerabilities in Node.js
See all- CVE-2026-21637High
A vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths, leading to immediate process termination or silent file descriptor leaks that eventually cause denial of service.
- CVE-2025-59466High
A bug has been identified in Node.js error handling where 'Maximum call stack size exceeded' errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications relying on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.
- CVE-2025-59464High
A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. Applications calling socket.getPeerCertificate(true) leak memory per certificate field, allowing remote clients to trigger steady memory growth through repeated TLS connections.
- CVE-2025-23166High
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs, potentially allowing an adversary to remotely crash a Node.js runtime.
- CVE-2025-23085Medium
A memory leak occurs in Node.js when a remote peer abruptly closes the socket without sending a GOAWAY notification, or when nghttp2 detects an invalid header and terminates the connection. This can lead to increased memory consumption and potential denial of service.
- CVE-2024-22018Low
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API, allowing malicious actors to retrieve stats from files they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
- CVE-2024-22020Medium
A flaw in Node.js allows bypassing network import restrictions by embedding non-network imports in data URLs. This enables an attacker to execute arbitrary code and compromise system security.
- CVE-2024-27982Medium
A critical vulnerability was identified in the HTTP server of the most recent Node version, where malformed headers can lead to HTTP request smuggling. Specifically, placing a space before a content-length header causes it to be misinterpreted, enabling attackers to smuggle a second request within the body of the first.
- CVE-2024-27983High
An attacker can make a Node.js HTTP/2 server completely unavailable by sending a small number of HTTP/2 frame packets. Data can remain in nghttp2 memory after a reset when headers with an HTTP/2 CONTINUATION frame are sent and the client abruptly closes the TCP connection, triggering a race condition.
- CVE-2015-7384High
Node.js versions 4.0.0, 4.1.0, and 4.1.1 allow remote attackers to cause a denial of service.
Original NVD description (English source)
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS