Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libuvUpgrade nodejs-nodemonUpgrade libuv-develUpgrade nodejs-packaging | May 4, 2022 | Jul 12, 2021 |
| Alpine Linux | — | Upgrade nodejs | Oct 1, 2024 | Jul 12, 2021 |
| Amazon Linux Ami 2 | — | Upgrade libuv-staticUpgrade libuvUpgrade libuv-debuginfoUpgrade libuv-devel | Jan 10, 2024 | Jul 12, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 12, 2021 |
| Centos_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-develUpgrade libuv-debuginfoUpgrade nodejs-docsUpgrade libuvUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade libuv-debugsourceUpgrade nodejs-packagingUpgrade nodejs-debugsource | Aug 12, 2021 | Jul 12, 2021 |
| Debian | — | Upgrade libuv1 | Jul 8, 2021 | Jul 8, 2021 |
| Freebsd | — | Upgrade node14Upgrade node | Nov 4, 2022 | Sep 21, 2021 |
| Gentoo Linux | — | Upgrade dev-libs/libuv.Upgrade net-libs/nodejs. | Jan 17, 2024 | Jul 12, 2021 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-14 to version 14.17.6-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs to version 14.17.6-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.22.5-11.4.38.0.1.101.2 on Solaris 11.4 | Nov 17, 2021 | Jul 12, 2021 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade libuv-develUpgrade nodejs-develUpgrade libuvUpgrade nodejsUpgrade npm | Aug 12, 2021 | Jul 1, 2021 |
| Redhat_linux | — | Upgrade libuvUpgrade nodejsUpgrade libuv-debuginfoUpgrade npmUpgrade nodejs-debugsourceUpgrade libuv-debugsourceUpgrade nodejs-packagingUpgrade libuv-develUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-nodemon | Aug 12, 2021 | Jul 12, 2021 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-full-i18nUpgrade libuvUpgrade nodejsUpgrade libuv-debuginfoUpgrade libuv-debugsourceUpgrade nodejs-develUpgrade libuv-devel | Mar 12, 2024 | Jul 12, 2021 |
| Suse | — | Upgrade nodejs14Upgrade nodejs14-docsUpgrade nodejs10Upgrade npm12Upgrade nodejs12-docsUpgrade npm10Upgrade nodejs12Upgrade npm14Upgrade nodejs14-develUpgrade nodejs10-docsUpgrade nodejs10-develUpgrade nodejs12-devel | Jul 15, 2021 | Jul 7, 2021 |
| Ubuntu | — | Upgrade libuv1 | Jul 8, 2021 | Jul 7, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub