A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Nov 19, 2020 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Aug 22, 2024 | Nov 19, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Nov 19, 2020 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs | Dec 21, 2020 | Nov 19, 2020 |
| Debian | — | Upgrade c-ares | Jul 30, 2024 | Nov 19, 2020 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 24, 2021 |
| Freebsd | — | Upgrade mysql80-serverUpgrade mysql56-serverUpgrade node14Upgrade mariadb105-serverUpgrade node12Upgrade mariadb103-serverUpgrade mysql57-serverUpgrade nodeUpgrade mariadb104-server | Nov 4, 2022 | Nov 21, 2020 |
| Gentoo Linux | — | Upgrade net-libs/nodejs.Upgrade net-dns/c-ares. | Dec 29, 2020 | Nov 19, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade c-ares | Jun 2, 2021 | Nov 19, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-12 to version 12.19.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.22.1-11.4.30.0.1.88.0 on Solaris 11.4Upgrade runtime/nodejs to version 12.19.1-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Nov 19, 2020 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docsUpgrade npm | Dec 18, 2020 | Nov 12, 2020 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejsUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-packaging | Dec 21, 2020 | Nov 19, 2020 |
| Rocky_linux | — | — | Aug 15, 2024 | Nov 19, 2020 |
| Suse | — | Upgrade nodejs12-docsUpgrade libcares2Upgrade nodejs14-docsUpgrade c-ares-utilsUpgrade libcares2-32bitUpgrade c-ares-develUpgrade nodejs14Upgrade nodejs14-develUpgrade npm12Upgrade nodejs12Upgrade nodejs12-develUpgrade npm14 | Nov 28, 2020 | Nov 19, 2020 |
| Ubuntu | — | Upgrade libc-ares2 | Mar 22, 2023 | Nov 19, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 19, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub