Skip to content
OpenAdvisories
Unscored CVE-2018-12120 EUVD-2018-4098GHSA-8fqw-43x4-4q75

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `n…

Published Nov 28, 2018 · Updated Oct 8, 2026 · Assigned by nodejs

Description

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Affected products

VendorProductAffectedFixed
The Node.js Project Node.js All versions prior to Node.js 6.15.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 nodejs 8.9.3~dfsg-5 —
Debian 13 nodejs 8.9.3~dfsg-5 —
Debian 12 nodejs 8.9.3~dfsg-5 —
ReleasePackageFixed inAdvisory
SLES 12 nodejs4 4.9.1-15.17.1 SUSE-SU-2019:0117-1
SLES 12 nodejs6 6.16.0-11.21.1 SUSE-SU-2019:0395-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE OpenStack Cloud Crowbar 8 nodejs6 6.16.0-11.21.1 SUSE-SU-2019:0395-1
SUSE OpenStack Cloud 7 nodejs6 6.16.0-11.21.1 SUSE-SU-2019:0395-1
SUSE Enterprise Storage 4 nodejs4 4.9.1-15.17.1 SUSE-SU-2019:0117-1
SUSE Enterprise Storage 4 nodejs6 6.16.0-11.21.1 SUSE-SU-2019:0395-1

Advisories 2

References