CVE-2022-33987: Vulnerability in got package allows redirect to a UNIX socket
Summary
CVE-2022-33987: Got allows a redirect to a UNIX socket. Affects got across 2 version ranges.
< 11.8.5
>= 12.0.0, < 12.1.0
Fixed in 11.8.5 or 12.1.0, depending on the release line you run. How to fix ↓
Also tracked for
- node-got · Debian:11
The same CVE-2022-33987 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The got package is a popular Node.js module used for making HTTP requests. It provides a simple and convenient API for sending HTTP requests and handling responses. The package is widely used in various Node.js applications and frameworks. However, versions before 11.8.5 and 12.1.0 of the got package are vulnerable to a redirect vulnerability that allows redirection to a UNIX socket.
Vulnerability Detail
The vulnerability in the got package allows an attacker to redirect HTTP requests to a UNIX socket. This can lead to various security issues, including potential information disclosure or unauthorized access to sensitive resources. By exploiting this vulnerability, an attacker can redirect requests to a malicious UNIX socket, potentially leading to further attacks or unauthorized actions. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 16.1.0 as of 22 Oct 2026
npm install got@16.1.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 11.8.511.8.5npm install got@11.8.5 -
>= 12.0.0, < 12.1.012.1.0npm install got@12.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, if updating the package is not immediately feasible, developers can consider implementing input validation and sanitization to prevent malicious redirects. It is important to carefully validate and sanitize any user-supplied input used in redirect logic to ensure it does not point to a UNIX socket or any other potentially malicious resource.
Conclusion
The got package before versions 11.8.5 and 12.1.0 is vulnerable to a redirect vulnerability that allows redirection to a UNIX socket. This can lead to various security risks, including information disclosure and unauthorized access. It is crucial to update the got package to the recommended versions or apply input validation and sanitization as a temporary workaround. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for got →
FAQ
This vulnerability allows an attacker to redirect HTTP requests to a UNIX socket, potentially leading to information disclosure or unauthorized access to sensitive resources.
Versions before 11.8.5 and 12.1.0 of the got package are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
Yes, updating the got package to version 11.8.5 or higher (for versions before 12.0.0) and version 12.1.0 or higher (for versions 12.0.0 and above) will fix this vulnerability.
As a workaround, you can implement input validation and sanitization to prevent malicious redirects. Validate and sanitize any user-supplied input used in redirect logic to ensure it does not point to a UNIX socket or any other potentially malicious resource.
