Skip to content
Fencer Intel
medium 5.3

CVE-2022-33987 json

Got allows a redirect to a UNIX socket

published 4y ago modified last mo. also GHSA-pfrx-2q88-qq97 , EUVD-2022-6110

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Patch / fix

  • npm got 11.8.5, 12.1.0
  • got_project got 11.8.5
  • node-got Debian 14, Debian 13, Debian 12 11.8.3+~cs58.7.37-3

debian advisories DEBIAN-CVE-2022-33987

  • npm RHEL 8 1:8.11.0-1.16.16.0.3.module+el8.6.0+16248+76b0e185
  • nodejs RHEL 8 1:16.16.0-3.module+el8.6.0+16248+76b0e185
  • nodejs-nodemon RHEL 8 2.0.19-2.module+el8.6.0+16240+7ca51420
  • nodejs-full-i18n RHEL 8 1:16.16.0-3.module+el8.6.0+16248+76b0e185
  • nodejs-packaging RHEL 8 25-1.module+el8.5.0+10992+fac5fe06
  • npm RHEL 8 1:6.14.17-1.14.20.0.2.module+el8.6.0+16231+7c1b33d9
  • nodejs RHEL 8 1:14.20.0-2.module+el8.6.0+16231+7c1b33d9
  • nodejs-nodemon RHEL 8 2.0.19-2.module+el8.6.0+16231+7c1b33d9

red hat advisories RHSA-2022:6449RHSA-2022:6448RHSA-2022:6985RHSA-2022:6595RHSA-2022:6389

  • nodejs AlmaLinux 9 1:16.16.0-1.el9_0
  • nodejs-nodemon AlmaLinux 9 2.0.19-1.el9_0
  • npm AlmaLinux 9 1:8.11.0-1.16.16.0.1.el9_0
  • nodejs-libs AlmaLinux 9 1:16.16.0-1.el9_0
  • nodejs-full-i18n AlmaLinux 9 1:16.16.0-1.el9_0
  • npm AlmaLinux 8 1:6.14.17-1.14.20.0.2.module_el8.6.0+3261+490666b3
  • nodejs AlmaLinux 8 1:14.20.0-2.module_el8.6.0+3261+490666b3
  • nodejs-nodemon AlmaLinux 8 2.0.19-2.module_el8.6.0+3261+490666b3

almalinux advisories ALSA-2022:6595ALSA-2022:6448

  • nodejs-nodemon Rocky Linux 9 2.0.19-1.el9_0
  • nodejs Rocky Linux 8 1:16.16.0-3.module+el8.6.0+1003+ae94235a
  • nodejs-nodemon Rocky Linux 8 2.0.19-2.module+el8.6.0+1046+80feca58
  • nodejs-nodemon Rocky Linux 8 2.0.19-2.module+el8.6.0+1003+ae94235a
  • nodejs-packaging Rocky Linux 8 25-1.module+el8.6.0+1046+80feca58
  • nodejs-packaging Rocky Linux 8 25-1.module+el8.5.0+702+221f14e6
  • nodejs Rocky Linux 8 1:14.20.0-2.module+el8.6.0+1004+df064614
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8

rocky linux advisories RLSA-2022:6595RLSA-2022:6449RLSA-2022:6448

Is CVE-2022-33987 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-33987 updated cvss 5.3

nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets

  • Red Hat .NET 6.0 on Red Hat Enterprise Linux rh-dotnet60-dotnet, rh-dotnet60-dotnet-host, rh-dotnet60-dotnet-sdk-6.0, rh-dotnet60-dotnet-hostfxr-6.0, rh-dotnet60-dotnet-runtime-6.0, rh-dotnet60-dotnet-templates-6.0, +6 more
    affected: no fix planned “Out of support scope”
  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-ui-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-grafana-prometheus
    affected: no fix available
  • Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana, openshift-service-mesh/kiali-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 6 firefox Red Hat Enterprise Linux 7 firefox
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 grafana, 389-ds-base, grafana-loki, grafana-mssql, grafana-mysql, cockpit-389-ds, +14 more
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 gjs, grafana, dotnet6.0, dotnet-host, dotnet-sdk-6.0, grafana-selinux, +9 more
    affected: no fix planned “Out of support scope”
  • Red Hat Fuse 7 got
    affected: no fix planned “Will not fix”
show 7 more
  • Red Hat JBoss Enterprise Application Platform 6 got Red Hat OpenShift Dev Spaces devspaces/code-rhel8, devspaces-theia-rhel8-container, devspaces-theia-endpoint-rhel8-container
    affected: no fix planned “Out of support scope”
  • Red Hat Quay 3 quay/quay-rhel8 Red Hat Single Sign-On 7 got Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n Red Hat Virtualization 4 ovirt-web-ui
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 14.20.0-2.module+el8.6.0+16231+7c1b33d9, nodejs 16.16.0-3.module+el8.6.0+16248+76b0e185, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-packaging 25-1.module+el8.5.0+10992+fac5fe06, npm 8.11.0-1.16.16.0.3.module+el8.6.0+16248+76b0e185, nodejs-nodemon 2.0.19-2.module+el8.6.0+16231+7c1b33d9, +4 more
    fixed: vendor fix RHSA-2022:6448
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs-nodemon 2.0.19-1.el9_0
    fixed: vendor fix RHSA-2022:6595
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs 14.20.0-2.module+el8.4.0+16234+70f4adc8, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.19-2.module+el8.4.0+16234+70f4adc8, npm 6.14.17-1.14.20.0.2.module+el8.4.0+16234+70f4adc8, nodejs-full-i18n 14.20.0-2.module+el8.4.0+16234+70f4adc8
    fixed: vendor fix RHSA-2022:6985
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs-nodemon 2.0.19-1.el7 Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs-nodemon 2.0.19-1.el7
    fixed: vendor fix RHSA-2022:6389
  • Red Hat OpenShift Developer Tools and Services odo Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8, rhacm2/console-rhel8, rhacm2/search-ui-rhel8, rhacm2/console-ui-rhel8, rhacm2/grc-ui-api-rhel8, rhacm2/search-api-rhel8, +2 more Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-docs-rhel8, advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator Red Hat Enterprise Linux 8 dotnet, cockpit, mozjs60, dotnet6.0, cockpit-ws, cockpit-pcp, +19 more Red Hat Enterprise Linux 9 polkit, polkit-libs Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.16.0-1.el9_0, nodejs-libs 16.16.0-1.el9_0, npm 8.11.0-1.16.16.0.1.el9_0, nodejs-full-i18n 16.16.0-1.el9_0
    +6 more products
    Red Hat OpenShift Container Platform 3.11 openshift3/ose-console Red Hat OpenShift Container Platform 4 openshift4/ose-console Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel8 Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs 14.20.0-2.el7, rh-nodejs14-npm 6.14.17-14.20.0.2.el7 Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs 14.20.0-2.el7, rh-nodejs14-npm 6.14.17-14.20.0.2.el7 Red Hat Virtualization 4 ovirt-engine-ui-extensions
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.42% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm got
>=12.0.0, <12.1.0
<11.8.5
12.1.0
11.8.5

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.