Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packaging | May 4, 2022 | Mar 3, 2021 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Mar 3, 2021 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade npm | Mar 8, 2021 | Mar 3, 2021 |
| Debian | — | Upgrade nodejs | Feb 26, 2021 | Feb 26, 2021 |
| Freebsd | — | Upgrade mysql80-serverUpgrade mariadb104-serverUpgrade mysql57-serverUpgrade nodeUpgrade mariadb105-serverUpgrade mariadb103-serverUpgrade node10Upgrade node12Upgrade node14 | Jul 20, 2021 | Jul 20, 2021 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Mar 3, 2021 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-10 to version 10.22.1-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-14 to version 14.16.0-11.4.33.0.1.94.0 on Solaris 11.4Upgrade runtime/nodejs to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4 | Apr 21, 2021 | Mar 3, 2021 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packaging | Mar 6, 2021 | Feb 18, 2021 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debugsource | Mar 8, 2021 | Mar 3, 2021 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-devel | Mar 12, 2024 | Mar 3, 2021 |
| Suse | — | Upgrade nodejs-commonUpgrade nodejs14Upgrade nodejs14-develUpgrade npm14Upgrade nodejs10Upgrade npm10Upgrade nodejs12Upgrade npm12Upgrade nodejs14-docsUpgrade nodejs12-develUpgrade npm8Upgrade nodejs8Upgrade nodejs10-docsUpgrade nodejs8-docsUpgrade nodejs8-develUpgrade nodejs10-develUpgrade nodejs12-docs | Feb 28, 2021 | Feb 26, 2021 |
| Ubuntu | — | Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode64Upgrade nodejsUpgrade libnode-dev | Oct 6, 2023 | Mar 3, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub