Description
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected products
- nodejs / node.js6.0.0 – 6.15.0
- nodejs / node.js11.0.0 – 11.3.0
- The Node.js Project / Node.jsAll versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0 – All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0
Updated 23m ago · 8 sources