Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-packaging | May 4, 2022 | Mar 3, 2021 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Mar 3, 2021 |
| Centos_linux | — | Upgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debuginfo | Mar 8, 2021 | Mar 3, 2021 |
| Debian | — | Upgrade nodejs | Feb 26, 2021 | Feb 26, 2021 |
| Freebsd | — | Upgrade mysql57-serverUpgrade mariadb104-serverUpgrade mysql80-serverUpgrade node10Upgrade mariadb105-serverUpgrade node14Upgrade nodeUpgrade node12Upgrade mariadb103-server | Jul 20, 2021 | Jul 20, 2021 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Mar 3, 2021 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-10 to version 10.22.1-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-14 to version 14.16.0-11.4.33.0.1.94.0 on Solaris 11.4 | Apr 21, 2021 | Mar 3, 2021 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade npmUpgrade nodejs-devel | Mar 6, 2021 | Feb 18, 2021 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejsUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-devel | Mar 8, 2021 | Mar 3, 2021 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs | Mar 12, 2024 | Mar 3, 2021 |
| Suse | — | Upgrade nodejs-commonUpgrade nodejs14-develUpgrade nodejs10Upgrade npm14Upgrade nodejs14Upgrade nodejs14-docsUpgrade nodejs10-docsUpgrade npm12Upgrade nodejs12-develUpgrade npm10Upgrade nodejs12-docsUpgrade nodejs10-develUpgrade nodejs8Upgrade npm8Upgrade nodejs8-docsUpgrade nodejs8-develUpgrade nodejs12 | Feb 28, 2021 | Feb 26, 2021 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode64Upgrade libnode-devUpgrade nodejs | Oct 6, 2023 | Mar 3, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub