Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade npm | May 4, 2022 | Mar 3, 2021 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Mar 3, 2021 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-nodemon | Mar 8, 2021 | Mar 3, 2021 |
| Debian | — | Upgrade nodejs | Feb 26, 2021 | Feb 26, 2021 |
| Freebsd | — | Upgrade mariadb103-serverUpgrade node12Upgrade nodeUpgrade node14Upgrade node10Upgrade mariadb105-serverUpgrade mysql57-serverUpgrade mysql80-serverUpgrade mariadb104-server | Jul 20, 2021 | Jul 20, 2021 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Mar 3, 2021 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-14 to version 14.16.0-11.4.33.0.1.94.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.22.1-11.4.32.0.1.88.2 on Solaris 11.4 | Apr 21, 2021 | Mar 3, 2021 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-nodemon | Mar 6, 2021 | Feb 18, 2021 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejsUpgrade npm | Mar 8, 2021 | Mar 3, 2021 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debugsource | Mar 12, 2024 | Mar 3, 2021 |
| Suse | — | Upgrade nodejs14-docsUpgrade nodejs12-develUpgrade npm12Upgrade nodejs12Upgrade npm8Upgrade nodejs8Upgrade nodejs8-develUpgrade nodejs8-docsUpgrade nodejs12-docsUpgrade nodejs10-develUpgrade npm10Upgrade nodejs10-docsUpgrade npm14Upgrade nodejs-commonUpgrade nodejs10Upgrade nodejs14-develUpgrade nodejs14 | Feb 28, 2021 | Feb 26, 2021 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode64Upgrade nodejsUpgrade libnode-dev | Oct 6, 2023 | Mar 3, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub