# Node.js 1.1.9 vulnerability in elastic docker agent image CVE-2023-4228

**URL:** <https://discuss.elastic.co/t/node-js-1-1-9-vulnerability-in-elastic-docker-agent-image-cve-2023-4228/355605>\
**Category:** Elastic Agent\
**Tags:** elastic-stack-security\
**Created:** [March 18, 2024, 1:03pm UTC](https://discuss.elastic.co/t/node-js-1-1-9-vulnerability-in-elastic-docker-agent-image-cve-2023-4228/355605 "2024-03-18T13:03:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![miksonx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/miksonx/32/129732_2.png) [@miksonx](https://discuss.elastic.co/u/miksonx)\
**Post date:** [March 18, 2024, 1:03pm UTC](https://discuss.elastic.co/t/node-js-1-1-9-vulnerability-in-elastic-docker-agent-image-cve-2023-4228/355605/1 "2024-03-18T13:03:23Z")

</div>

This issue is related to docker image elastic-agent-complete (8.12.1, 8.12.2)

According the [CVE-2023-4228](https://nvd.nist.gov/vuln/detail/CVE-2023-42282) the Node.js 1.1.9 version is vulnerable.

### Description

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

**Base Score:** [9.8 CRITICAL](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?name=CVE-2023-42282&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1&source=NIST)

Please remediate the vulnerability and provide latest image without vulnerability.

---

<div class="post-metadata">

**Author:** ![georgii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/georgii/32/78076_2.png) [@georgii](https://discuss.elastic.co/u/georgii)\
**Post date:** [March 18, 2024, 1:39pm UTC](https://discuss.elastic.co/t/node-js-1-1-9-vulnerability-in-elastic-docker-agent-image-cve-2023-4228/355605/2 "2024-03-18T13:39:14Z")

</div>

Hi @miksonx, thank you for letting us know. Elastic accepts reports / information about security vulnerabilities in Elastic products via [security@elastic.co](mailto:security@elastic.co). Could you please send an email to this address? This would kick off the process of addressing this issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 15, 2024, 1:39pm UTC](https://discuss.elastic.co/t/node-js-1-1-9-vulnerability-in-elastic-docker-agent-image-cve-2023-4228/355605/3 "2024-04-15T13:39:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.