CVE-2018-12123: nodejs node.js Misinterpretation of Input
Vulnerability summary
CVE-2018-12123 is a medium (CVSS 4.3) Misinterpretation of Input vulnerability in nodejs node.js. EPSS estimates a 4.03% chance of exploitation in the next 30 days, higher than 90.6% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 6Timeline
- 28-11-2018PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS trend
Probability
4.03%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
Decrease -0.02 pp
From 4.05% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-115Misinterpretation of InputThe product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine2 products
- nodejs< 10.14.0-r0 | < 8.14.0-r0
- nodejs-current< 11.3.0-r0
Debian1 product
- nodejs< 10.15.0~dfsg-6
Nodejs1 product
- node.js≥ 6.0.0, < 6.15.0 | ≥ 8.0.0, < 8.14.0 | ≥ 10.0.0, < 10.14.0 | ≥ 11.0.0, < 11.3.0
The node.js project1 product
- node.jsAll versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0
Ubuntu1 product
- nodejsAll versions (No fix recorded) | < 8.10.0~dfsg-2ubuntu0.4+esm1
5 vendors · 6 products
References
10 links- nodejs.org/en/blog/vulnerability/november-2018-security-releases/X Refsource CONFIRMPatchVendor AdvisoryREPORT
