CVE-2024-22020: Node.js Node

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.

Affected products

• Node.js Node: from 4.0, before 5 (fixed in 5); from 5.0, before 6 (fixed in 6); from 6.0, before 7 (fixed in 7); from 7.0, before 8 (fixed in 8); from 8.0, before 9 (fixed in 9); from 9.0, before 10 (fixed in 10); …
• Node.js Node.js: version 21.6.1 only; version 20.11.0 only; version 18.19.0 only

Published 2024-07-09. Last modified 2026-06-17.