A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging | May 4, 2022 | Nov 19, 2020 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Aug 22, 2024 | Nov 19, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 19, 2020 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-debuginfo | Dec 21, 2020 | Nov 19, 2020 |
| Debian | — | Upgrade c-ares | Jul 30, 2024 | Nov 19, 2020 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 24, 2021 |
| Freebsd | — | Upgrade mariadb105-serverUpgrade node14Upgrade mysql56-serverUpgrade mariadb103-serverUpgrade mysql57-serverUpgrade node12Upgrade mysql80-serverUpgrade mariadb104-serverUpgrade node | Nov 4, 2022 | Nov 21, 2020 |
| Gentoo Linux | — | Upgrade net-dns/c-ares.Upgrade net-libs/nodejs. | Dec 29, 2020 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade c-ares | Jun 2, 2021 | Nov 19, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-12 to version 12.19.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.22.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade runtime/nodejs to version 12.19.1-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Nov 19, 2020 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs | Dec 18, 2020 | Nov 12, 2020 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-nodemon | Dec 21, 2020 | Nov 19, 2020 |
| Rocky_linux | — | — | Aug 15, 2024 | Nov 19, 2020 |
| Suse | — | Upgrade nodejs14-docsUpgrade libcares2-32bitUpgrade nodejs12-docsUpgrade c-ares-develUpgrade libcares2Upgrade nodejs14Upgrade c-ares-utilsUpgrade nodejs12-develUpgrade npm14Upgrade nodejs14-develUpgrade nodejs12Upgrade npm12 | Nov 28, 2020 | Nov 19, 2020 |
| Ubuntu | — | Upgrade libc-ares2 | Mar 22, 2023 | Nov 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub