Is CVE-2022-25881 in the CISA KEV catalog?

No. CVE-2022-25881 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2022-25881?

CVE-2022-25881 has a CVSS v3 base score of 5.3 (MEDIUM).

What is the EPSS score for CVE-2022-25881?

CVE-2022-25881 has an EPSS score of 1.61% (73th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2022-25881?

Upgrade nodejs on rocky 8 to 1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src::nodejs:18 or later. Fixes are available for 24 affected products.

CVE & CISA-KEV Catalog

CVE-2022-25881

MEDIUMEPSS 73th pctl

5.3

CVSS v3

NVD

Description

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

CWE-1333

How to fix

Remediation Available

nodejsRocky

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64::nodejs:18RHSA-2023:2654

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

nodejsRed Hat / RHEL

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.src::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64::nodejs:18RHSA-2023:2654

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

nodejs-debuginfoRocky

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64::nodejs:18RHSA-2023:2654

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

nodejs-debuginfoRed Hat / RHEL

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18RHSA-2023:2654

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

nodejs-debugsourceRocky

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18RHSA-2023:2654

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

nodejs-debugsourceRed Hat / RHEL

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64::nodejs:18RHSA-2023:2654

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

nodejs-develRocky

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18RHSA-2023:2654

nodejs-develRed Hat / RHEL

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18RHSA-2023:2654

nodejs-docsRed Hat / RHEL

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch::nodejs:18RHSA-2023:2654

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

nodejs-docsRocky

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.noarch::nodejs:18RHSA-2023:2654

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

nodejs-full-i18nRed Hat / RHEL

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18RHSA-2023:2654

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

nodejs-full-i18nRocky

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18RHSA-2023:2654

Fixed in:1:18.14.2-2.module+el9.2.0.z+18497+a402347c.x86_64::nodejs:18RHSA-2023:2654

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

nodejs-libsRocky

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

nodejs-libsRed Hat / RHEL

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

nodejs-libs-debuginfoRocky

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

nodejs-libs-debuginfoRed Hat / RHEL

Fixed in:1:16.19.1-1.el9_2RHSA-2023:2655

Fixed in:1:16.20.2-1.el9_0RHSA-2023:5533

nodejs-nodemonRocky

Fixed in:0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch::nodejs:18RHSA-2023:2654

Fixed in:0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src::nodejs:18RHSA-2023:2654

Fixed in:0:2.0.20-3.el9_2RHSA-2023:2655

nodejs-nodemonRed Hat / RHEL

Fixed in:0:2.0.20-2.module+el9.2.0.z+18497+a402347c.src::nodejs:18RHSA-2023:2654

Fixed in:0:2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch::nodejs:18RHSA-2023:2654

Fixed in:0:2.0.20-3.el9_2RHSA-2023:2655

nodejs-packagingRocky

Fixed in:0:2021.06-4.module+el9.1.0+15718+e52ec601.src::nodejs:18RHSA-2023:2654

Fixed in:0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch::nodejs:18RHSA-2023:2654

nodejs-packagingRed Hat / RHEL

Fixed in:0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch::nodejs:18RHSA-2023:2654

Fixed in:0:2021.06-4.module+el9.1.0+15718+e52ec601.src::nodejs:18RHSA-2023:2654

nodejs-packaging-bundlerRed Hat / RHEL

Fixed in:0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch::nodejs:18RHSA-2023:2654

nodejs-packaging-bundlerRocky

Fixed in:0:2021.06-4.module+el9.1.0+15718+e52ec601.noarch::nodejs:18RHSA-2023:2654

npmRocky

Fixed in:1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18RHSA-2023:2654

Fixed in:1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18RHSA-2023:2654

Fixed in:1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18RHSA-2023:2654

Fixed in:1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64::nodejs:18RHSA-2023:2654

Fixed in:1:8.19.3-1.16.19.1.1.el9_2RHSA-2023:2655

Fixed in:1:8.19.4-1.16.20.2.1.el9_0RHSA-2023:5533

Fixed in:1:8.19.3-1.16.19.1.1.el9_2RHSA-2023:2655

npmRed Hat / RHEL

Fixed in:1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.ppc64le::nodejs:18RHSA-2023:2654

Fixed in:1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.s390x::nodejs:18RHSA-2023:2654

Fixed in:1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.aarch64::nodejs:18RHSA-2023:2654

Fixed in:1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c.x86_64::nodejs:18RHSA-2023:2654

Fixed in:1:8.19.4-1.16.20.2.1.el9_0RHSA-2023:5533

Fixed in:1:8.19.3-1.16.19.1.1.el9_2RHSA-2023:2655

Fixed in:1:8.19.4-1.16.20.2.1.el9_0RHSA-2023:5533

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityLow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploit Intelligence

1.61%probability of exploitation in 30 days

73rdpercentile

Elevated risk: more likely to be exploited than 73% of all known CVEs.

References

Exploit2

Other references2

Embed a live status badge for CVE-2022-25881

Markdown

[![CVE-2022-25881](https://tridentstack.com/cve/badge/CVE-2022-25881.svg)](https://tridentstack.com/cve/CVE-2022-25881)

HTML

<a href="https://tridentstack.com/cve/CVE-2022-25881"><img src="https://tridentstack.com/cve/badge/CVE-2022-25881.svg" alt="CVE-2022-25881"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-03-27.