NodeJS debugger command injection - security recommendation 11869

[Theyssens]

Dear community,

I've received a new security recommendation to upgrade NodeJS to version 8.0.0 (before the upgrade we were at v14) and to disable unauthenticated debugger access to remediate this vulnerability. NodeJS however doesn't have the debugger anymore since version 8.

Along with the recent NodeJS upgrade, I have closed down port 5858 via the windows firewall (not via NSG yet) but the recommendation remains.

Any ideas?

regards,

Koen