{"id":47956,"date":"2026-05-09T15:58:46","date_gmt":"2026-05-09T08:58:46","guid":{"rendered":"https:\/\/antoanthongtinhaiphong.gov.vn\/?p=47956"},"modified":"2026-05-29T15:59:36","modified_gmt":"2026-05-29T08:59:36","slug":"11-lo-hong-nghiem-trong-trong-vm2-de-doa-hang-loat-he-thong-node-js","status":"publish","type":"post","link":"https:\/\/antoanthongtinhaiphong.gov.vn\/11-lo-hong-nghiem-trong-trong-vm2-de-doa-hang-loat-he-thong-node-js\/","title":{"rendered":"11 l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong vm2 \u0111e d\u1ecda h\u00e0ng lo\u1ea1t h\u1ec7 th\u1ed1ng Node.js"},"content":{"rendered":"
M\u1ed9t lo\u1ea1t l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt \u0111\u1eb7c bi\u1ec7t nghi\u00eam tr\u1ecdng v\u1eeba \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n trong th\u01b0 vi\u1ec7n vm2, c\u01a1 ch\u1ebf sandbox ph\u1ed5 bi\u1ebfn c\u1ee7a h\u1ec7 sinh th\u00e1i Node.js, khi\u1ebfn h\u00e0ng lo\u1ea1t n\u1ec1n t\u1ea3ng th\u1ef1c thi m\u00e3 tr\u1ef1c tuy\u1ebfn, h\u1ec7 th\u1ed1ng CI\/CD v\u00e0 d\u1ecbch v\u1ee5 \u0111a tenant \u0111\u1ed1i m\u1eb7t nguy c\u01a1 b\u1ecb chi\u1ebfm quy\u1ec1n ho\u00e0n to\u00e0n.<\/b><\/p>\n

Theo c\u00f4ng b\u1ed1 m\u1edbi nh\u1ea5t t\u1eeb d\u1ef1 \u00e1n vm2 tr\u00ean GitHub, c\u00f3 t\u1edbi 11 l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn t\u1ea5t c\u1ea3 phi\u00ean b\u1ea3n vm2 t\u1eeb 3.11.1 tr\u1edf v\u1ec1 tr\u01b0\u1edbc. \u0110\u00e1ng lo ng\u1ea1i, to\u00e0n b\u1ed9 c\u00e1c l\u1ed7i n\u00e0y \u0111\u1ec1u cho ph\u00e9p tin t\u1eb7c tho\u00e1t kh\u1ecfi m\u00f4i tr\u01b0\u1eddng sandbox \u0111\u1ec3 th\u1ef1c thi m\u00e3 t\u00f9y \u00fd tr\u00ean m\u00e1y ch\u1ee7 g\u1ed1c, t\u1eeb \u0111\u00f3 ph\u00e1 v\u1ee1 ho\u00e0n to\u00e0n m\u00f4 h\u00ecnh b\u1ea3o m\u1eadt c\u1ed1t l\u00f5i m\u00e0 vm2 theo \u0111u\u1ed5i su\u1ed1t nhi\u1ec1u n\u0103m qua. C\u00e1c l\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c ghi nh\u1eadn \u0111\u1ec1u c\u00f3 m\u1ee9c \u0111\u1ed9 nghi\u00eam tr\u1ecdng r\u1ea5t cao v\u1edbi \u0111i\u1ec3m CVSS ch\u1ee7 y\u1ebfu t\u1eeb 9.1 \u0111\u1ebfn 10.0. Trong \u0111\u00f3, c\u00f3 hai l\u1ed7 h\u1ed5ng v\u1eabn ch\u01b0a c\u00f3 b\u1ea3n v\u00e1 ch\u00ednh th\u1ee9c, l\u00e0m gia t\u0103ng th\u00eam m\u1ee9c \u0111\u1ed9 r\u1ee7i ro \u0111\u1ed1i v\u1edbi c\u00e1c h\u1ec7 th\u1ed1ng \u0111ang tri\u1ec3n khai vm2.\u200b<\/p><\/div>\n

 <\/p>\n

\n
\"1778220819896.png\"<\/div>\n

\u1ea2nh: Bleeping Computer<\/i>
\n\u200b<\/div>\n

vm2 l\u00e0 m\u1ed9t package npm \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng r\u1ed9ng r\u00e3i \u0111\u1ec3 ch\u1ea1y m\u00e3 JavaScript kh\u00f4ng tin c\u1eady trong m\u00f4i tr\u01b0\u1eddng c\u00f4 l\u1eadp. C\u00f4ng ngh\u1ec7 n\u00e0y xu\u1ea5t hi\u1ec7n trong nhi\u1ec1u n\u1ec1n t\u1ea3ng cho ph\u00e9p ng\u01b0\u1eddi d\u00f9ng ch\u1ea1y code tr\u1ef1c ti\u1ebfp tr\u00ean web, c\u00e1c h\u1ec7 th\u1ed1ng plugin, d\u1ecbch v\u1ee5 SaaS \u0111a ng\u01b0\u1eddi d\u00f9ng, pipeline CI\/CD v\u00e0 c\u1ea3 nhi\u1ec1u s\u1ea3n ph\u1ea9m AI c\u00f3 kh\u1ea3 n\u0103ng th\u1ef1c thi script \u0111\u1ed9ng.<\/p>\n

To\u00e0n b\u1ed9 m\u00f4 h\u00ecnh b\u1ea3o m\u1eadt c\u1ee7a vm2 \u0111\u01b0\u1ee3c x\u00e2y d\u1ef1ng tr\u00ean m\u1ed9t nguy\u00ean t\u1eafc \u0111\u01a1n gi\u1ea3n r\u1eb1ng m\u00e3 \u0111\u1ed9c ch\u1ec9 \u0111\u01b0\u1ee3c ph\u00e9p ho\u1ea1t \u0111\u1ed9ng trong sandbox v\u00e0 kh\u00f4ng th\u1ec3 truy c\u1eadp h\u1ec7 \u0111i\u1ec1u h\u00e0nh th\u1eadt. Tuy nhi\u00ean, c\u00e1c nghi\u00ean c\u1ee9u m\u1edbi cho th\u1ea5y l\u1edbp c\u00f4 l\u1eadp n\u00e0y kh\u00f4ng c\u00f2n mang t\u00ednh tuy\u1ec7t \u0111\u1ed1i khi c\u00f3 th\u1ec3 b\u1ecb xuy\u00ean th\u1ee7ng th\u00f4ng qua nhi\u1ec1u k\u1ef9 thu\u1eadt kh\u00e1c nhau, tr\u1ea3i d\u00e0i t\u1eeb thao t\u00fang prototype JavaScript, l\u1ea1m d\u1ee5ng Promise species cho t\u1edbi khai th\u00e1c WebAssembly v\u00e0 c\u01a1 ch\u1ebf exception m\u1edbi c\u1ee7a Node.js.\u200b<\/p><\/div>\n

C\u00e1c l\u1ed7 h\u1ed5ng trong th\u01b0 vi\u1ec7n Node.js vm2<\/b>\u200b<\/div>\n
Nghi\u00eam tr\u1ecdng nh\u1ea5t l\u00e0 CVE-2026-24118, l\u1ed7 h\u1ed5ng cho ph\u00e9p khai th\u00e1c h\u00e0nh vi c\u1ee7a __lookupGetter__ \u0111\u1ec3 \u201cb\u1ebb kh\u00f3a\u201d c\u01a1 ch\u1ebf c\u00f4 l\u1eadp, t\u1eeb \u0111\u00f3 tho\u00e1t kh\u1ecfi sandbox v\u00e0 ch\u1ea1m tr\u1ef1c ti\u1ebfp v\u00e0o m\u00f4i tr\u01b0\u1eddng host. \u0110i song song v\u1edbi \u0111\u00f3, CVE-2026-24120 l\u1ea1i m\u1edf ra m\u1ed9t h\u01b0\u1edbng t\u1ea5n c\u00f4ng nguy hi\u1ec3m h\u01a1n khi l\u1ee3i d\u1ee5ng c\u01a1 ch\u1ebf Promise species \u0111\u1ec3 v\u01b0\u1ee3t qua c\u00e1c r\u00e0o ch\u1eafn b\u1ea3o v\u1ec7, r\u1ed3i \u00e2m th\u1ea7m k\u00edch ho\u1ea1t child_process.execSync, bi\u1ebfn m\u1ed9t \u0111o\u1ea1n m\u00e3 t\u01b0\u1edfng nh\u01b0 b\u1ecb c\u00f4 l\u1eadp th\u00e0nh c\u00f4ng c\u1ee5 th\u1ef1c thi l\u1ec7nh h\u1ec7 th\u1ed1ng tr\u00ean m\u00e1y ch\u1ee7. Hai l\u1ed7 h\u1ed5ng n\u00e0y, d\u00f9 khai th\u00e1c theo nh\u1eefng c\u01a1 ch\u1ebf ho\u00e0n to\u00e0n kh\u00e1c nhau, l\u1ea1i c\u00f9ng d\u1eabn \u0111\u1ebfn m\u1ed9t \u0111i\u1ec3m chung: ph\u00e1 v\u1ee1 l\u1edbp sandbox v\u1ed1n \u0111\u01b0\u1ee3c xem l\u00e0 \u201ctuy\u1ebfn ph\u00f2ng th\u1ee7 cu\u1ed1i c\u00f9ng\u201d c\u1ee7a vm2 v\u00e0 m\u1edf \u0111\u01b0\u1eddng tr\u1ef1c ti\u1ebfp cho k\u1ecbch b\u1ea3n RCE tr\u00ean host.<\/p>\n

M\u1ed9t l\u1ed7 h\u1ed5ng \u0111\u00e1ng ch\u00fa \u00fd kh\u00e1c l\u00e0 CVE-2026-24781, khai th\u00e1c m\u00f4-\u0111un util c\u1ee7a Node.js \u0111\u1ec3 th\u1ef1c hi\u1ec7n ki\u1ec3m tra n\u1ed9i b\u1ed9 c\u00e1c object, t\u1eeb \u0111\u00f3 l\u00e0m l\u1ed9 c\u00e1c \u0111\u1ed1i t\u01b0\u1ee3ng nguy\u00ean g\u1ed1c t\u1eeb m\u00e1y ch\u1ee7. Khi \u0111\u00e3 truy c\u1eadp \u0111\u01b0\u1ee3c l\u1edbp d\u1eef li\u1ec7u n\u00e0y, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 v\u01b0\u1ee3t qua c\u01a1 ch\u1ebf proxy isolation c\u1ee7a vm2, ph\u00e1 v\u1ee1 ho\u00e0n to\u00e0n r\u00e0o ch\u1eafn gi\u1eefa sandbox v\u00e0 m\u00f4i tr\u01b0\u1eddng host.<\/p>\n

Kh\u00f4ng d\u1eebng l\u1ea1i \u1edf c\u00e1c API c\u0169, nh\u1eefng c\u01a1 ch\u1ebf JavaScript hi\u1ec7n \u0111\u1ea1i c\u0169ng tr\u1edf th\u00e0nh b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng m\u1edbi. CVE-2026-26332 khai th\u00e1c s\u1ef1 k\u1ebft h\u1ee3p gi\u1eefa DisposableStack v\u00e0 c\u01a1 ch\u1ebf SuppressedError trong Node.js v24 \u0111\u1ec3 t\u1eebng b\u01b0\u1edbc l\u00e0m l\u1ed9 \u0111\u1ed1i t\u01b0\u1ee3ng Function t\u1eeb ph\u00eda host. Khi \u0111\u1ea1t \u0111\u01b0\u1ee3c quy\u1ec1n truy c\u1eadp n\u00e0y, sandbox g\u1ea7n nh\u01b0 m\u1ea5t ho\u00e0n to\u00e0n kh\u1ea3 n\u0103ng ki\u1ec3m so\u00e1t th\u1ef1c thi m\u00e3.<\/p>\n

Sang Node.js v25, CVE-2026-26956 ti\u1ebfp t\u1ee5c m\u1edf r\u1ed9ng b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng khi l\u1ee3i d\u1ee5ng l\u1ec7nh try_table c\u1ee7a WebAssembly \u0111\u1ec3 v\u01b0\u1ee3t qua to\u00e0n b\u1ed9 c\u01a1 ch\u1ebf sanitize c\u1ee7a vm2. \u0110i\u1ec3m \u0111\u00e1ng lo ng\u1ea1i l\u00e0 k\u1ef9 thu\u1eadt n\u00e0y kh\u00f4ng ch\u1ec9 d\u1eebng \u1edf vi\u1ec7c tho\u00e1t sandbox, m\u00e0 trong th\u1eed nghi\u1ec7m th\u1ef1c t\u1ebf \u0111\u00e3 cho ph\u00e9p th\u1ef1c thi m\u00e3 \u1edf c\u1ea5p \u0111\u1ed9 root tr\u00ean h\u1ec7 th\u1ed1ng.<\/p>\n

Song song v\u1edbi \u0111\u00f3, nhi\u1ec1u l\u1ed7 h\u1ed5ng kh\u00e1c l\u1ea1i t\u1eadp trung v\u00e0o chu\u1ed7i prototype v\u00e0 c\u01a1 ch\u1ebf n\u1ea1p module c\u1ee7a Node.js nh\u01b0 CVE-2026-43997 v\u00e0 CVE-2026-44006. Hai l\u1ed7 h\u1ed5ng khai th\u00e1c util.inspect k\u1ebft h\u1ee3p prototype traversal \u0111\u1ec3 ti\u1ebfp t\u1ee5c m\u1edf \u0111\u01b0\u1eddng tho\u00e1t kh\u1ecfi sandbox, t\u1eebng b\u01b0\u1edbc \u0111\u01b0a m\u00e3 \u0111\u1ed9c quay tr\u1edf l\u1ea1i ng\u1eef c\u1ea3nh host. Trong khi \u0111\u00f3, CVE-2026-43999 cho ph\u00e9p v\u01b0\u1ee3t qua c\u01a1 ch\u1ebf ch\u1eb7n module built-in c\u1ee7a vm2 b\u1eb1ng c\u00e1ch g\u1ecdi tr\u1ef1c ti\u1ebfp Module._load(), ngay c\u1ea3 khi c\u00e1c module nh\u1ea1y c\u1ea3m nh\u01b0 child_process \u0111\u00e3 b\u1ecb ch\u1eb7n trong c\u1ea5u h\u00ecnh.<\/p>\n

M\u1ed9t v\u1ea5n \u0111\u1ec1 mang t\u00ednh h\u1ec7 th\u1ed1ng kh\u00e1c l\u00e0 CVE-2026-44005, li\u00ean quan \u0111\u1ebfn prototype pollution. L\u1ed7 h\u1ed5ng n\u00e0y cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng s\u1eeda \u0111\u1ed5i c\u00e1c prototype d\u00f9ng chung nh\u01b0 Object.prototype ho\u1eb7c Function.prototype, t\u1eeb \u0111\u00f3 \u1ea3nh h\u01b0\u1edfng kh\u00f4ng ch\u1ec9 sandbox m\u00e0 c\u1ea3 to\u00e0n b\u1ed9 ti\u1ebfn tr\u00ecnh Node.js, t\u1ea1o ra r\u1ee7i ro lan r\u1ed9ng ngo\u00e0i ph\u1ea1m vi ban \u0111\u1ea7u. B\u00ean c\u1ea1nh \u0111\u00f3, m\u1ed9t l\u1ed7i c\u1ea5u h\u00ecnh nghi\u00eam tr\u1ecdng \u0111\u01b0\u1ee3c theo d\u00f5i v\u1edbi m\u00e3 GHSA-8hg8-63c5-gwmx cho th\u1ea5y khi b\u1eadt t\u00f9y ch\u1ecdn nesting: true, c\u01a1 ch\u1ebf require: false g\u1ea7n nh\u01b0 b\u1ecb v\u00f4 hi\u1ec7u h\u00f3a. \u0110i\u1ec1u n\u00e0y cho ph\u00e9p m\u00e3 \u0111\u1ed9c t\u1ea1o c\u00e1c VM l\u1ed3ng nhau, v\u01b0\u1ee3t qua m\u1ecdi gi\u1edbi h\u1ea1n v\u00e0 \u0111\u1ea1t \u0111\u01b0\u1ee3c th\u1ef1c thi m\u00e3 t\u1eeb xa d\u00f9 sandbox v\u1eabn \u0111ang \u0111\u01b0\u1ee3c b\u1eadt.<\/p>\n

\u0110\u00e1ng lo ng\u1ea1i nh\u1ea5t l\u00e0 hai l\u1ed7 h\u1ed5ng CVE-2026-44008 v\u00e0 CVE-2026-44009 hi\u1ec7n v\u1eabn ch\u01b0a c\u00f3 b\u1ea3n v\u00e1 tr\u00ean c\u00e1c phi\u00ean b\u1ea3n \u0111\u1ebfn 3.11.1. Hai l\u1ed7i n\u00e0y khai th\u00e1c c\u00e1ch vm2 x\u1eed l\u00fd array species c\u00f9ng logic ngo\u1ea1i l\u1ec7, t\u1eeb \u0111\u00f3 l\u00e0m l\u1ed9 c\u00e1c \u0111\u1ed1i t\u01b0\u1ee3ng ph\u00eda host v\u00e0 kh\u00f4i ph\u1ee5c quy\u1ec1n truy c\u1eadp t\u1edbi Function constructor, th\u00e0nh ph\u1ea7n c\u1ed1t l\u00f5i c\u00f3 th\u1ec3 d\u1eabn t\u1edbi ph\u00e1 v\u1ee1 ho\u00e0n to\u00e0n c\u01a1 ch\u1ebf c\u00f4 l\u1eadp v\u00e0 th\u1ef1c thi m\u00e3 t\u00f9y \u00fd tr\u00ean h\u1ec7 th\u1ed1ng.
\n\u200b<\/p><\/div>\n

\n
\"1778220991370.png\"<\/div>\n<\/div>\n

 <\/p>\n

\nS\u1ef1 xu\u1ea5t hi\u1ec7n li\u00ean ti\u1ebfp c\u1ee7a h\u00e0ng lo\u1ea1t l\u1ed7 h\u1ed5ng cho th\u1ea5y vm2 \u0111ang \u0111\u1ed1i m\u1eb7t v\u1edbi m\u1ed9t v\u1ea5n \u0111\u1ec1 mang t\u00ednh ki\u1ebfn tr\u00fac khi m\u00f4 h\u00ecnh sandbox thu\u1ea7n JavaScript kh\u00f4ng c\u00f2n theo k\u1ecbp s\u1ef1 ph\u00e1t tri\u1ec3n nhanh c\u1ee7a Node.js v\u00e0 c\u00e1c c\u01a1 ch\u1ebf n\u1ed9i t\u1ea1i nh\u01b0 prototype, Promise hay WebAssembly. Khi runtime ng\u00e0y c\u00e0ng ph\u1ee9c t\u1ea1p, c\u00e1c l\u1edbp c\u00f4 l\u1eadp \u1edf t\u1ea7ng \u1ee9ng d\u1ee5ng d\u1ec5 b\u1ecb v\u01b0\u1ee3t qua, khi\u1ebfn kh\u1ea3 n\u0103ng \u0111\u1ea3m b\u1ea3o an to\u00e0n c\u1ee7a sandbox n\u00e0y d\u1ea7n suy gi\u1ea3m trong c\u00e1c m\u00f4i tr\u01b0\u1eddng hi\u1ec7n \u0111\u1ea1i.<\/p>\n

C\u00e1c chuy\u00ean gia khuy\u1ebfn ngh\u1ecb qu\u1ea3n tr\u1ecb vi\u00ean c\u1ea7n c\u1eadp nh\u1eadt ngay vm2 l\u00ean phi\u00ean b\u1ea3n 3.11.1 \u0111\u1ec3 x\u1eed l\u00fd c\u00e1c l\u1ed7 h\u1ed5ng \u0111\u00e3 c\u00f3 b\u1ea3n v\u00e1, \u0111\u1ed3ng th\u1eddi tr\u00e1nh s\u1eed d\u1ee5ng c\u1ea5u h\u00ecnh nesting: true ho\u1eb7c c\u00e1c wildcard built-in ki\u1ec3u [‘*’, ‘-child_process’] trong m\u00f4i tr\u01b0\u1eddng ch\u1ea1y m\u00e3 kh\u00f4ng tin c\u1eady.<\/p>\n

V\u1edbi nh\u1eefng h\u1ec7 th\u1ed1ng y\u00eau c\u1ea7u m\u1ee9c c\u00f4 l\u1eadp cao, c\u00e1c t\u1ed5 ch\u1ee9c n\u00ean c\u00e2n nh\u1eafc chuy\u1ec3n sang c\u00e1c c\u01a1 ch\u1ebf c\u00e1ch ly \u1edf c\u1ea5p kernel nh\u01b0 Docker, gVisor ho\u1eb7c Firecracker microVM thay v\u00ec ti\u1ebfp t\u1ee5c ph\u1ee5 thu\u1ed9c v\u00e0o sandbox JavaScript.
\n\u200b<\/p><\/div>\n

T\u1ed5ng h\u1ee3p<\/i><\/b><\/div>\n","protected":false},"excerpt":{"rendered":"

M\u1ed9t lo\u1ea1t l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt \u0111\u1eb7c bi\u1ec7t nghi\u00eam tr\u1ecdng v\u1eeba \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n trong th\u01b0 vi\u1ec7n vm2, c\u01a1 ch\u1ebf sandbox ph\u1ed5 bi\u1ebfn c\u1ee7a h\u1ec7 sinh th\u00e1i Node.js, khi\u1ebfn h\u00e0ng lo\u1ea1t n\u1ec1n t\u1ea3ng th\u1ef1c thi m\u00e3 tr\u1ef1c tuy\u1ebfn, h\u1ec7 th\u1ed1ng CI\/CD v\u00e0 d\u1ecbch v\u1ee5 \u0111a tenant \u0111\u1ed1i m\u1eb7t nguy c\u01a1 b\u1ecb chi\u1ebfm quy\u1ec1n ho\u00e0n to\u00e0n. […]<\/p>\n","protected":false},"author":20,"featured_media":47957,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[3,24,35],"tags":[],"class_list":["post-47956","post","type-post","status-publish","format-standard","has-post-thumbnail","category-canh-bao-khuyen-nghi","category-tin-noi-bat","category-tin-tuc-su-kien"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/47956","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/comments?post=47956"}],"version-history":[{"count":1,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/47956\/revisions"}],"predecessor-version":[{"id":47958,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/47956\/revisions\/47958"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media\/47957"}],"wp:attachment":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media?parent=47956"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/categories?post=47956"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/tags?post=47956"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}