CVE-2022-33987 affects the Node.js 'got' package prior to versions 12.1.0 and 11.8.5, allowing a redirect to a UNIX socket. Rated as Medium severity (CVSS 5.3), this vulnerability has a low impact on integrity and no impact on confidentiality or availability, requiring no user interaction or privileges. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 11.8.5CPE matchmatch criteria | cpe:2.3:a:got_project:got:*:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Third-Party Package Updates in Enterprise Security 8.1.0 - July 2025
Jul 30, 2025August 2023 Third Party Package Updates in Splunk Enterprise
Aug 30, 2023June Third Party Package Updates in Splunk Cloud
Jun 1, 2023Got allows a redirect to a UNIX socket
Jun 19, 2022nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets
Jun 18, 2022