Description
Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Node.js Project | Node.js | All versions prior to Node.js 6.15.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nodejs | 8.9.3~dfsg-5 | — |
| Debian 13 | nodejs | 8.9.3~dfsg-5 | — |
| Debian 12 | nodejs | 8.9.3~dfsg-5 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | nodejs4 | 4.9.1-15.17.1 | SUSE-SU-2019:0117-1 |
| SLES 12 | nodejs6 | 6.16.0-11.21.1 | SUSE-SU-2019:0395-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 8 | nodejs6 | 6.16.0-11.21.1 | SUSE-SU-2019:0395-1 |
| SUSE OpenStack Cloud 7 | nodejs6 | 6.16.0-11.21.1 | SUSE-SU-2019:0395-1 |
| SUSE Enterprise Storage 4 | nodejs4 | 4.9.1-15.17.1 | SUSE-SU-2019:0117-1 |
| SUSE Enterprise Storage 4 | nodejs6 | 6.16.0-11.21.1 | SUSE-SU-2019:0395-1 |
Advisories 2
- SUSE-SU-2019:0395-1 Security update for nodejs6 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0117-1 Security update for nodejs4 SUSE / openSUSE Security Updates · Feb 4, 2026