CVE-2022-33987: Medium severity Got Project Got Node.js vulnerability

Published Jun 18, 2022
·
Updated

A flaw was found in the got package for node.js. Requested URLs are not verified and allow open redirection to a local UNIX socket.

Other sources

Node.js got module could allow a remote attacker to bypass security restrictions, caused by an unspecified. By sending a specially-crafted request, an attacker could exploit this vulnerability to perform a redirect to a UNIX socket.

— IBM

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Affected Software

11 affected componentsFixes available
redhat/nodejs-nodemon<0:2.0.19-1.el9_0
0:2.0.19-1.el9_0
redhat/rh-nodejs14-nodejs-nodemon<0:2.0.19-1.el7
0:2.0.19-1.el7
Got Project Got Node.js<11.8.5
redhat/got<11.8.5
11.8.5
redhat/got<12.1.0
12.1.0
IBM Data Virtualization on Cloud Pak for Data<=3.0
IBM Watson Query on Cloud Pak for Data<=2.2
IBM Watson Query on Cloud Pak for Data<=2.1
IBM Watson Query on Cloud Pak for Data<=2.0
IBM Data Virtualization on Cloud Pak for Data<=1.8
IBM Data Virtualization on Cloud Pak for Data<=1.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/nodejs-nodemon to a version that resolves this vulnerability.

    Fixed in 0:2.0.19-1.el9_0
  2. Upgrade

    Upgrade redhat/rh-nodejs14-nodejs-nodemon to a version that resolves this vulnerability.

    Fixed in 0:2.0.19-1.el7
  3. Upgrade

    Upgrade redhat/got to a version that resolves this vulnerability.

    Fixed in 11.8.5
  4. Upgrade

    Upgrade redhat/got to a version that resolves this vulnerability.

    Fixed in 12.1.0
  5. Upgrade

    Upgrade got to a version that resolves this vulnerability.

    Fixed in 12.1.0
  6. Upgrade

    Upgrade got to a version that resolves this vulnerability.

    Fixed in 11.8.5
  7. Compensating control

    Restrict egress/egress-to-local services so applications cannot reach UNIX socket endpoints via redirects (mitigate the redirect-to-UNIX-socket issue for got versions before 12.1.0 / 11.8.5).

Event History

Jun 18, 2022
CVE Published
12:00 AM
CVE Published
via MITRE·08:51 PM
Data Sourced
via MITRE·08:51 PM
Description
Jun 29, 2022
Data Sourced
via Red Hat·04:50 AM
DescriptionSeverityAffected Software
Aug 15, 2025
Data Sourced
via IBM·03:29 PM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2022-33987?

CVE-2022-33987 has been classified with a severity that indicates significant security risks associated with open redirection vulnerabilities.

2

How do I fix CVE-2022-33987?

To fix CVE-2022-33987, update the `got` package to version 12.1.0 or later.

3

What software is affected by CVE-2022-33987?

CVE-2022-33987 affects the `got` package versions up to 11.8.5 and various node.js related packages.

4

What type of vulnerability is CVE-2022-33987?

CVE-2022-33987 is an open redirection vulnerability that could allow attackers to bypass security restrictions.

5

Can CVE-2022-33987 allow unauthorized access?

Yes, CVE-2022-33987 can potentially allow an attacker to redirect requests to unauthorized local UNIX sockets.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203