CVE-2022-36127: Service unavailability impact in NodeJS agent(version <= 0.5.0)

Security readout for executives and security teams

CVE-2022-36127 can make Node.js services unavailable when they run Apache SkyWalking NodeJS Agent 0.5.0 or earlier and the SkyWalking OAP backend is unhealthy or unreachable. The concern is operational outage, not data theft, based on the provided sources. Exposure is limited to Node.js services with Apache SkyWalking NodeJS Agent version 0.5.0 or earlier, especially where OAP instability or network loss is plausible. Treat this as a targeted availability risk for instrumented Node.js services. It deserves prompt remediation where SkyWalking is deployed on business-critical systems, but the sources do not support emergency exploitation claims. Mitigation focus: Upgrade Apache SkyWalking NodeJS Agent to 0.5.1 or later.; Inventory Node.js services using SkyWalking NodeJS Agent.; Prioritize critical services where monitoring outages could affect production availability..

Prepared

Jun 2, 2026, 08:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.