high7.5
CVE-2022-36127
Apache SkyWalking NodeJS Agent can lose availability if header includes illegal SkyWalking header
Impact
A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | skywalking-backend-js | < 0.5.1 | 0.5.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Skywalking Nodejs Agent | before 0.5.1 |
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2022/07/18/1
- https://lists.apache.org/thread/x238wo4r5goy39dxdjcmlofp6gcdnqr3
- https://github.com/advisories/GHSA-8gpg-466c-5cpj
- https://nvd.nist.gov/vuln/detail/CVE-2022-36127
- https://skywalking.apache.org/events/release-apache-skywalking-nodejs-0-5-1/