{"id":"CVE-2018-7160","revision":null,"records":[{"revision":"7e9f0f131a3b43d8bea53b60da811743","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2018-7160","aliases":[],"title":"The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another …","description":"The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.","state":0,"publishedAt":"2018-05-17T14:00:00+00:00","modifiedAt":"2026-10-08T21:14:05.004+00:00","affected":[{"ecosystem":"Vendor product","name":"Node.js","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Node.js\",\n                    \"vendor\": \"The Node.js Project\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"^6.0.0 || ^8.0.0 || ^9.0.0\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://www.oracle.com//security-alerts/cpujul2021.html","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://support.f5.com/csp/article/K63025104?utm_source=f5support&amp%3Butm_medium=RSS"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2018-7160","license":"CVE Program Terms of Use","key":"cve-program:CVE-2018-7160","identifiers":["CVE-2018-7160"]},"retained":false,"historicalAffected":[]},{"revision":"c6809a98bf1b4cd7a7e63e31c758992e","observedAt":"2026-11-09T19:03:22.093+00:00","statement":{"source":"euvd","id":"EUVD-2022-5619","aliases":["CVE-2018-7160","GHSA-wq4c-wm6x-jw44"],"title":"The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another …","description":"The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[],"references":["https://www.oracle.com//security-alerts/cpujul2021.html","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://support.f5.com/csp/article/K63025104?utm_source=f5support&amp%3Butm_medium=RSS"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5619","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 17, 2018, 2:00:00 PM","dateUpdated":"Oct 8, 2026, 9:14:05 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2019:14246-1","title":"Security update for Mozilla Firefox","vulnerabilityIds":["CVE-2013-2882","CVE-2013-6639","CVE-2013-6640","CVE-2013-6668","CVE-2014-0224","CVE-2015-3193","CVE-2015-3194","CVE-2015-5380","CVE-2015-7384","CVE-2016-2086","CVE-2016-2178","CVE-2016-2183","CVE-2016-2216","CVE-2016-5172","CVE-2016-5325","CVE-2016-6304","CVE-2016-6306","CVE-2016-7052","CVE-2016-7099","CVE-2017-1000381","CVE-2017-10686","CVE-2017-11111","CVE-2017-11499","CVE-2017-14228","CVE-2017-14849","CVE-2017-14919","CVE-2017-15896","CVE-2017-15897","CVE-2017-17810","CVE-2017-17811","CVE-2017-17812","CVE-2017-17813","CVE-2017-17814","CVE-2017-17815","CVE-2017-17816","CVE-2017-17817","CVE-2017-17818","CVE-2017-17819","CVE-2017-17820","CVE-2017-18207","CVE-2017-3735","CVE-2017-3736","CVE-2017-3738","CVE-2018-0732","CVE-2018-1000168","CVE-2018-12115","CVE-2018-12116","CVE-2018-12121","CVE-2018-12122","CVE-2018-12123","CVE-2018-20406","CVE-2018-20852","CVE-2018-7158","CVE-2018-7159","CVE-2018-7160","CVE-2018-7161","CVE-2018-7167","CVE-2019-10160","CVE-2019-11709","CVE-2019-11710","CVE-2019-11711","CVE-2019-11712","CVE-2019-11713","CVE-2019-11714","CVE-2019-11715","CVE-2019-11716","CVE-2019-11717","CVE-2019-11718","CVE-2019-11719","CVE-2019-11720","CVE-2019-11721","CVE-2019-11723","CVE-2019-11724","CVE-2019-11725","CVE-2019-11727","CVE-2019-11728","CVE-2019-11729","CVE-2019-11730","CVE-2019-11733","CVE-2019-11735","CVE-2019-11736","CVE-2019-11738","CVE-2019-11740","CVE-2019-11742","CVE-2019-11743","CVE-2019-11744","CVE-2019-11746","CVE-2019-11747","CVE-2019-11748","CVE-2019-11749","CVE-2019-11750","CVE-2019-11751","CVE-2019-11752","CVE-2019-11753","CVE-2019-11757","CVE-2019-11758","CVE-2019-11759","CVE-2019-11760","CVE-2019-11761","CVE-2019-11762","CVE-2019-11763","CVE-2019-11764","CVE-2019-13173","CVE-2019-15903","CVE-2019-5010","CVE-2019-5737","CVE-2019-9511","CVE-2019-9512","CVE-2019-9513","CVE-2019-9514","CVE-2019-9515","CVE-2019-9516","CVE-2019-9517","CVE-2019-9518","CVE-2019-9636","CVE-2019-9811","CVE-2019-9812","CVE-2019-9947"]},{"id":"RHSA-2018:2949","title":"Red Hat Security Advisory: rh-nodejs8-nodejs security update","vulnerabilityIds":["CVE-2018-7159","CVE-2018-7160","CVE-2018-7161","CVE-2018-7167","CVE-2018-12115"]},{"id":"SUSE-SU-2018:1183-1","title":"Security update for nodejs6","vulnerabilityIds":["CVE-2018-7158","CVE-2018-7159","CVE-2018-7160"]},{"id":"WID-SEC-W-2023-0561","title":"Xerox FreeFlow Print Server: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2023-21900","CVE-2023-21843","CVE-2023-21835","CVE-2023-21830","CVE-2022-46882","CVE-2022-46881","CVE-2022-46880","CVE-2022-46878","CVE-2022-46875","CVE-2022-46874","CVE-2022-46872","CVE-2022-45421","CVE-2022-45420","CVE-2022-45419","CVE-2022-45418","CVE-2022-45417","CVE-2022-45416","CVE-2022-45415","CVE-2022-45414","CVE-2022-45413","CVE-2022-45412","CVE-2022-45411","CVE-2022-45410","CVE-2022-45409","CVE-2022-45408","CVE-2022-45407","CVE-2022-45406","CVE-2022-45405","CVE-2022-45404","CVE-2022-45403","CVE-2022-45063","CVE-2022-45061","CVE-2022-44638","CVE-2022-43680","CVE-2022-43548","CVE-2022-42932","CVE-2022-42929","CVE-2022-42928","CVE-2022-42927","CVE-2022-42252","CVE-2022-41556","CVE-2022-41323","CVE-2022-40962","CVE-2022-40960","CVE-2022-40959","CVE-2022-40958","CVE-2022-40957","CVE-2022-40956","CVE-2022-40674","CVE-2022-3970","CVE-2022-39260","CVE-2022-39253","CVE-2022-3786","CVE-2022-37797","CVE-2022-37454","CVE-2022-37436","CVE-2022-36760","CVE-2022-3627","CVE-2022-3626","CVE-2022-36087","CVE-2022-36059","CVE-2022-3602","CVE-2022-3599","CVE-2022-3598","CVE-2022-3597","CVE-2022-3570","CVE-2022-35256","CVE-2022-35255","CVE-2022-34526","CVE-2022-3276","CVE-2022-32222","CVE-2022-32215","CVE-2022-32213","CVE-2022-32212","CVE-2022-3204","CVE-2022-3190","CVE-2022-31630","CVE-2022-31629","CVE-2022-31628","CVE-2022-3155","CVE-2022-3034","CVE-2022-3033","CVE-2022-3032","CVE-2022-29458","CVE-2022-29187","CVE-2022-29154","CVE-2022-2869","CVE-2022-2868","CVE-2022-2867","CVE-2022-27406","CVE-2022-27405","CVE-2022-27404","CVE-2022-26981","CVE-2022-24765","CVE-2022-24070","CVE-2022-23901","CVE-2022-22844","CVE-2022-2210","CVE-2022-2208","CVE-2022-2207","CVE-2022-2206","CVE-2022-2183","CVE-2022-2175","CVE-2022-21658","CVE-2022-21628","CVE-2022-21626","CVE-2022-21624","CVE-2022-21619","CVE-2022-2125","CVE-2022-2122","CVE-2022-2058","CVE-2022-2057","CVE-2022-2056","CVE-2022-1925","CVE-2022-1924","CVE-2022-1923","CVE-2022-1922","CVE-2022-1921","CVE-2022-1920","CVE-2022-1348","CVE-2022-1056","CVE-2022-0924","CVE-2022-0909","CVE-2022-0908","CVE-2022-0907","CVE-2022-0891","CVE-2022-0865","CVE-2022-0562","CVE-2022-0561","CVE-2021-46848","CVE-2021-46823","CVE-2021-42694","CVE-2021-42574","CVE-2021-37750","CVE-2021-28544","CVE-2020-10735","CVE-2019-6111","CVE-2018-7160","CVE-2015-20107","CVE-2006-20001"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2022-5619","identifiers":["EUVD-2022-5619","CVE-2018-7160","GHSA-wq4c-wm6x-jw44"]},"retained":false,"historicalAffected":[]},{"revision":"9ce21b27cbb048dbb18a30f5ebc08c76","observedAt":"2026-10-24T15:17:10.449+00:00","statement":{"source":"nvd","id":"CVE-2018-7160","aliases":[],"title":"The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another …","description":"The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.","state":0,"publishedAt":"2018-05-17T14:29:00.827+00:00","modifiedAt":"2026-10-08T22:16:47.647+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"},{"system":"CVSS 2.0 · nvd@nist.gov · Primary","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","score":6.8,"severity":"MEDIUM"}],"references":["https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://support.f5.com/csp/article/K63025104?utm_source=f5support&amp%3Butm_medium=RSS","https://www.oracle.com//security-alerts/cpujul2021.html"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-7160","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-350","CWE-290"],"productCriteria":["cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"sourceDates":{"published":"2018-05-17T14:29:00.827","lastModified":"2026-10-08T22:16:47.647"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2018-7160","identifiers":["CVE-2018-7160"]},"retained":false,"historicalAffected":[]},{"revision":"6584c62c1d374b4d9a08bcb22ad091b4","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-wq4c-wm6x-jw44","aliases":["CVE-2018-7160"],"title":"Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because this vulnerability affects inspector code in https://github.com/nodejs/node, not the [legacy debugger](https://nodejs.org/en/docs/inspector#legacy-debugger) at https://github.com/node-inspector/node-inspector. https://github.com/nodejs/node is not in a [supported ecosystem](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems).\n\n## Original Description\nThe Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.","state":2,"publishedAt":"2022-05-13T01:08:23+00:00","modifiedAt":"2026-09-10T03:49:43.2861474+00:00","affected":[{"ecosystem":"npm","name":"node-inspector","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"6.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2018-7160","https://github.com/nodejs/node/commit/e3950d1a402b80e4098a40aacddd6a104da0cfa9","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases","https://support.f5.com/csp/article/K63025104?utm_source=f5support&utm_medium=RSS","https://www.oracle.com//security-alerts/cpujul2021.html"],"sourceUrl":"https://github.com/advisories/GHSA-wq4c-wm6x-jw44","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wq4c-wm6x-jw44","identifiers":["GHSA-wq4c-wm6x-jw44","CVE-2018-7160"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T15:24:08.8188023+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T15:24:08.8188023+00:00","lastSuccessAt":"2026-11-10T15:24:08.9790817+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.9790869+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-a0960c299e2dafbb2e8450fb21550287bc0c3b97298514596ae2b1697fb7bc3b","complete":true,"records":422070,"lastAttemptAt":"2026-11-10T15:21:29.3452518+00:00","lastSuccessAt":"2026-11-10T15:21:29.2151501+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:21:29.3452518+00:00","snapshotPublishedAt":"2026-11-10T14:23:49+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-efc28183efe04e138ba7d91d47b051d0","complete":true,"records":13691,"lastAttemptAt":"2026-11-10T15:25:10.8168504+00:00","lastSuccessAt":"2026-11-10T13:22:39.879+00:00","error":null,"lastVerifiedAt":"2026-11-10T13:22:39.879+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13744,"expectedIdentifiers":13744,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T15:24:08.8188023+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T15:24:08.8188023+00:00","lastSuccessAt":"2026-11-10T15:24:08.9798315+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.9798317+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-738cd6499f9748c9890b05108858c833","complete":false,"records":13697,"lastAttemptAt":"2026-11-10T15:25:10.154636+00:00","lastSuccessAt":"2026-11-10T15:25:10.15+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T15:25:10.15+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13142,"expectedIdentifiers":13744,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T15:24:08.6813477+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.6813477+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T15:21:29.495451+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:21:29.495451+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-df497239f2f75af38e095cb498791dad4044a8a9a7f5f0ee6008bb732579ab9d","complete":true,"records":3081,"lastAttemptAt":"2026-11-10T15:24:08.7869291+00:00","lastSuccessAt":"2026-11-10T14:21:34.3717399+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.7869291+00:00","snapshotPublishedAt":"2026-11-10T14:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-db2f6ba81f9ad8cbb9260cd64e408b90232da96003174aeed666a4ce1c7aabd5","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T15:24:08.5102562+00:00","lastSuccessAt":"2026-11-10T15:24:05.6823404+00:00","error":null,"lastVerifiedAt":"2026-11-10T15:24:08.5102562+00:00","snapshotPublishedAt":"2026-11-10T14:33:27+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}