Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs | May 4, 2022 | Aug 16, 2021 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Aug 16, 2021 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-devel | Sep 22, 2021 | Aug 16, 2021 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 15, 2021 |
| Freebsd | — | Upgrade mysql-connector-javaUpgrade mariadb104-serverUpgrade mysql80-serverUpgrade mysql57-serverUpgrade mariadb105-serverUpgrade mariadb103-serverUpgrade nodeUpgrade mysql80-clientUpgrade node14 | Nov 4, 2022 | Oct 17, 2021 |
| Gentoo Linux | — | Upgrade net-libs/nodejs.Upgrade net-dns/c-ares. | Jan 8, 2024 | Aug 16, 2021 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-16 to version 16.11.1-11.4.39.0.1.107.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.22.5-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs to version 14.17.6-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-14 to version 14.17.6-11.4.38.0.1.101.2 on Solaris 11.4 | Nov 17, 2021 | Aug 16, 2021 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-full-i18n | Sep 23, 2021 | Aug 11, 2021 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejsUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-debugsource | Sep 22, 2021 | Aug 16, 2021 |
| Rocky_linux | — | Upgrade npmUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-debugsource | May 5, 2022 | Aug 16, 2021 |
| Suse | — | Upgrade npm10Upgrade nodejs14-docsUpgrade npm12Upgrade nodejs10-develUpgrade nodejs14Upgrade nodejs12Upgrade nodejs12-docsUpgrade nodejs14-develUpgrade nodejs12-develUpgrade nodejs10Upgrade npm14Upgrade nodejs10-docs | Aug 31, 2021 | Aug 16, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 16, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub