Node.js Updates Fix Inspector DNS Rebinding, ICU Loading and OpenSSL Flaws

Node.js and Linux distributors released security updates addressing vulnerabilities that could enable arbitrary code execution, security-policy bypasses and denial of service. CVE-2022-43548 allows octal-formatted IP addresses to bypass the Node.js inspector’s DNS rebinding protection; exploitation requires an active, exposed and reachable inspector session plus specific DNS and host conditions. Debian’s DLA-3344-1 also fixes CVE-2023-23920, which concerns potentially unsafe ICU data loading when Node.js runs with elevated privileges. Both fixes are included in 10.24.0~dfsg-1~deb10u3 for Debian 10 Buster, and Red Hat lists fixes for affected Enterprise Linux and Software Collections packages.

The related upstream security releases covered Node.js 14, 16, 18 and 19, with affected versions varying by flaw. November 2022 updates addressed OpenSSL certificate name-constraint buffer overflows affecting Node.js 18 and 19 that could cause crashes or potentially remote code execution under specific certificate-validation conditions. February 2023 updates incorporated further OpenSSL fixes and addressed an experimental policy bypass, cryptographic error-state handling that could cause denial of service, and carriage-return/line-feed injection in the Fetch API’s Host header. The associated OpenSSL advisory identified eight vulnerabilities, including CVE-2023-0286, an X.400 address type confusion that can expose memory or cause denial of service during certificate revocation list checking. Administrators should apply the relevant vendor-supported Node.js updates, restrict inspector access, and check separately managed OpenSSL installations against the advisory’s fixed versions: 3.0.8, 1.1.1t or 1.0.2zg, depending on branch.