CVE•Published 2018-11-28•Modified 2026-10-08•1 article on news•5 live references•NVD data

CVE-2018-12120Nodejs · Node.js

Vulnerability data via NVD (ingested)

CVSS v3.1

8.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS percentile

Exploit Prediction Scoring System · top 9% of all CVEs

Weaknesses (CWE)

CWE-419Unprotected Primary Channel CWE-829Inclusion of Functionality from Untrusted Control Sphere

Description

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Timeline

Published 2018-11-28

Modified 2026-10-08

External references

NVD MITRE Exploit-DB GitHub PoC VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2018-12120

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Nodejs Node.js"

All exposed Nodejs Node.js instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Node.js"

HTTP body or banner mentions "Node.js" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2018-12120