A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Nov 19, 2020 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | Nov 19, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 19, 2020 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade npmUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-devel | Dec 21, 2020 | Nov 19, 2020 |
| Debian | — | Upgrade c-ares | Jul 30, 2024 | Nov 19, 2020 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 24, 2021 |
| Freebsd | — | Upgrade mysql56-serverUpgrade mariadb103-serverUpgrade mariadb105-serverUpgrade mysql80-serverUpgrade mysql57-serverUpgrade node14Upgrade node12Upgrade mariadb104-serverUpgrade node | Nov 4, 2022 | Nov 21, 2020 |
| Gentoo Linux | — | Upgrade net-dns/c-ares.Upgrade net-libs/nodejs. | Dec 29, 2020 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade c-ares | Jun 2, 2021 | Nov 19, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-10 to version 10.22.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.19.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade runtime/nodejs to version 12.19.1-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Nov 19, 2020 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-develUpgrade npm | Dec 18, 2020 | Nov 12, 2020 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-debuginfo | Dec 21, 2020 | Nov 19, 2020 |
| Rocky_linux | — | — | Aug 15, 2024 | Nov 19, 2020 |
| Suse | — | Upgrade nodejs12-develUpgrade npm14Upgrade npm12Upgrade nodejs12Upgrade nodejs14-develUpgrade nodejs14-docsUpgrade libcares2Upgrade nodejs14Upgrade c-ares-develUpgrade nodejs12-docsUpgrade c-ares-utilsUpgrade libcares2-32bit | Nov 28, 2020 | Nov 19, 2020 |
| Ubuntu | — | Upgrade libc-ares2 | Mar 22, 2023 | Nov 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub