CVE-2018-12120

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 6.15.0

Description The issue allows remote computers to attach to the debug port and evaluate arbitrary JavaScript when the debugger is enabled with node --debug or node debug, as it listens on all interfaces by default. The default interface is now localhost. It has always been possible to start the debugger on a specific interface. The debugger was removed in Node.js 8 and replaced with the inspector.

Recommendations For Node.js versions prior to 6.15.0, consider starting the debugger on a specific interface, such as node --debug=localhost, to minimize the risk of exploitation.