CVE-2022-43548: 
npm vulnerability analysis and mitigation

A DNS rebinding vulnerability (CVE-2022-43548) was discovered in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1. The vulnerability exists due to an insufficient IsAllowedHost check that can be bypassed because IsIPAddress does not properly validate invalid IP addresses before making DNS requests, allowing rebinding attacks (Node.js Blog).

The vulnerability specifically affects the Node.js rebinding protector for --inspect functionality. The protector still allows invalid IP addresses in octal format (e.g., 1.09.0.0, where 09 is invalid in base-8). Browsers like Firefox will still attempt to resolve these invalid octal addresses via DNS. When combined with an active --inspect session, such as when using VSCode, this can enable DNS rebinding attacks (Node.js Blog).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, modification of data, and potential arbitrary code execution when combined with an active --inspect debugging session (NetApp Advisory).

The vulnerability has been fixed in Node.js versions 14.21.1, 16.18.1, 18.12.1, and 19.0.1. Users should upgrade to these or later versions to mitigate the vulnerability (Node.js Blog).