A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging | May 4, 2022 | Nov 19, 2020 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Aug 22, 2024 | Nov 19, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 19, 2020 |
| Centos_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-debuginfo | Dec 21, 2020 | Nov 19, 2020 |
| Debian | — | Upgrade c-ares | Jul 30, 2024 | Nov 19, 2020 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 24, 2021 |
| Freebsd | — | Upgrade mariadb104-serverUpgrade nodeUpgrade mysql57-serverUpgrade mariadb105-serverUpgrade node12Upgrade node14Upgrade mariadb103-serverUpgrade mysql56-serverUpgrade mysql80-server | Nov 4, 2022 | Nov 21, 2020 |
| Gentoo Linux | — | Upgrade net-dns/c-ares.Upgrade net-libs/nodejs. | Dec 29, 2020 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade c-ares | Jun 2, 2021 | Nov 19, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 12.19.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.19.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.22.1-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Nov 19, 2020 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-nodemon | Dec 18, 2020 | Nov 12, 2020 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-docs | Dec 21, 2020 | Nov 19, 2020 |
| Rocky_linux | — | — | Aug 15, 2024 | Nov 19, 2020 |
| Suse | — | Upgrade npm12Upgrade nodejs12-develUpgrade npm14Upgrade nodejs14-develUpgrade nodejs12Upgrade libcares2-32bitUpgrade c-ares-utilsUpgrade nodejs12-docsUpgrade libcares2Upgrade nodejs14Upgrade nodejs14-docsUpgrade c-ares-devel | Nov 28, 2020 | Nov 19, 2020 |
| Ubuntu | — | Upgrade libc-ares2 | Mar 22, 2023 | Nov 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub