VulnerableCode Package Details - pkg:deb/debian/nodejs@8.11.1~dfsg-2?distro=trixie

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-nkas-113k-wkbu	nodejs: HTTP parser allowed for spaces inside Content-Length header values	CVE-2018-7159
VCID-u8pe-48f4-abc9	Authentication Bypass by Spoofing The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.	CVE-2018-7160 GHSA-wq4c-wm6x-jw44

Vulnerability

Summary

Aliases

VCID-nkas-113k-wkbu

nodejs: HTTP parser allowed for spaces inside Content-Length header values

CVE-2018-7159

VCID-u8pe-48f4-abc9

Authentication Bypass by Spoofing The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.

CVE-2018-7160
GHSA-wq4c-wm6x-jw44

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T12:44:14.558337+00:00	Debian Importer	Fixing	VCID-nkas-113k-wkbu	https://security-tracker.debian.org/tracker/data/json	38.4.0
2026-04-16T10:25:08.321260+00:00	Debian Importer	Fixing	VCID-u8pe-48f4-abc9	https://security-tracker.debian.org/tracker/data/json	38.4.0
2026-04-13T08:44:02.912520+00:00	Debian Importer	Fixing	VCID-nkas-113k-wkbu	https://security-tracker.debian.org/tracker/data/json	38.3.0
2026-04-13T07:01:34.971761+00:00	Debian Importer	Fixing	VCID-u8pe-48f4-abc9	https://security-tracker.debian.org/tracker/data/json	38.3.0
2026-04-03T07:47:21.500394+00:00	Debian Importer	Fixing	VCID-u8pe-48f4-abc9	https://security-tracker.debian.org/tracker/data/json	38.1.0
2026-04-03T07:47:21.459290+00:00	Debian Importer	Fixing	VCID-nkas-113k-wkbu	https://security-tracker.debian.org/tracker/data/json	38.1.0