A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Nov 19, 2020 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Aug 22, 2024 | Nov 19, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 19, 2020 |
| Centos_linux | — | Upgrade nodejsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-packaging | Dec 21, 2020 | Nov 19, 2020 |
| Debian | — | Upgrade c-ares | Jul 30, 2024 | Nov 19, 2020 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 24, 2021 |
| Freebsd | — | Upgrade node14Upgrade mariadb105-serverUpgrade mariadb103-serverUpgrade mysql56-serverUpgrade mysql80-serverUpgrade node12Upgrade mysql57-serverUpgrade mariadb104-serverUpgrade node | Nov 4, 2022 | Nov 21, 2020 |
| Gentoo Linux | — | Upgrade net-dns/c-ares.Upgrade net-libs/nodejs. | Dec 29, 2020 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade c-ares | Jun 2, 2021 | Nov 19, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 12.19.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.22.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.19.1-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Nov 19, 2020 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade npmUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs | Dec 18, 2020 | Nov 12, 2020 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsource | Dec 21, 2020 | Nov 19, 2020 |
| Rocky_linux | — | — | Aug 15, 2024 | Nov 19, 2020 |
| Suse | — | Upgrade nodejs12Upgrade nodejs12-develUpgrade nodejs14-develUpgrade npm14Upgrade npm12Upgrade c-ares-utilsUpgrade libcares2Upgrade nodejs14Upgrade nodejs14-docsUpgrade nodejs12-docsUpgrade c-ares-develUpgrade libcares2-32bit | Nov 28, 2020 | Nov 19, 2020 |
| Ubuntu | — | Upgrade libc-ares2 | Mar 22, 2023 | Nov 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub