Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding

Also known as GHSA-wq4c-wm6x-jw44

Published 8 y ago 2018-05-17 · modified 31 d ago 2026-10-08 · JSON

CVSS

8.8

v3.1 · NVD

CISA KEV

not known exploited

EPSS

9.5%

percentile 95%

Public exploits

none known

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 31 d ago 2026-10-08

Exploit prediction (EPSS)

9.49% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`
GitHub	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
npm	`node-inspector`	>=6.0	no fix listed

Affected products

The Node.js Project Node.js

Classification

Weakness

CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action
CWE-290 Authentication Bypass by Spoofing

Technology feeds

Node.js (RSS, critical only)

References

oracle.com //security-alerts/cpujul2021.html · x_refsource_MISC, x_transferred
nodejs.org /en/blog/vulnerability/march-2018-security-releases/ · x_refsource_CONFIRM, x_transferred
support.f5.com /csp/article/K63025104?utm_source=f5support&amp%3Butm_medium=RSS · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-7160 · advisory
github.com /nodejs/node/commit/e3950d1a402b80e4098a40aacddd6a104da0cfa9 · web
nodejs.org /en/blog/vulnerability/march-2018-security-releases · web
support.f5.com /csp/article/K63025104?utm_source=f5support&utm_medium=RSS · web

Sources

CVE List: CVE-2018-7160
GitHub Advisory: GHSA-wq4c-wm6x-jw44
NVD: CVE-2018-7160

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary