CVE-2018-7160

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.

• CWE-350
• CWE-290

• https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/Vendor Advisory
• https://support.f5.com/csp/article/K63025104?utm_source=f5support&amp%3Butm_medium=RSS
• https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
• https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/Vendor Advisory
• https://support.f5.com/csp/article/K63025104?utm_source=f5support&amp%3Butm_medium=RSS
• https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory

Published

May 17, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7154Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-7155Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-7156Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-7157Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-7158The `'path'` module in the Node.js 4.x release line contains…7.5
• CVE-2018-7159The HTTP parser in all current versions of Node.js ignores s…5.3
• CVE-2018-7161All versions of Node.js 8.x, 9.x, and 10.x are vulnerable an…7.5
• CVE-2018-7162All versions of Node.js 9.x and 10.x are vulnerable and the …7.5
• CVE-2018-7164Node.js versions 9.7.0 and later and 10.x are vulnerable and…7.5
• CVE-2018-7166In all versions of Node.js 10 prior to 10.9.0, an argument p…7.5
• CVE-2018-7167Calling Buffer.fill() or Buffer.alloc() with some parameters…7.5
• CVE-2018-7169An issue was discovered in shadow 4.5. newgidmap (in shadow-…