The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-docs | May 4, 2022 | Mar 3, 2021 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Mar 3, 2021 |
| Centos_linux | — | Upgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade npm | Mar 8, 2021 | Mar 3, 2021 |
| Debian | — | Upgrade nodejs | Feb 26, 2021 | Feb 26, 2021 |
| Freebsd | — | Upgrade nodeUpgrade node14Upgrade node10Upgrade mariadb105-serverUpgrade mariadb103-serverUpgrade node12Upgrade mysql57-serverUpgrade mariadb104-serverUpgrade mysql80-server | Jul 20, 2021 | Jul 20, 2021 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Mar 3, 2021 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-12 to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.22.1-11.4.32.0.1.88.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-14 to version 14.16.0-11.4.33.0.1.94.0 on Solaris 11.4Upgrade runtime/nodejs to version 12.21.0-11.4.32.0.1.88.2 on Solaris 11.4 | Apr 21, 2021 | Mar 3, 2021 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-develUpgrade npmUpgrade nodejs-docs | Mar 6, 2021 | Feb 18, 2021 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-packaging | Mar 8, 2021 | Mar 3, 2021 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debugsource | Mar 12, 2024 | Mar 3, 2021 |
| Suse | — | Upgrade npm14Upgrade nodejs-commonUpgrade nodejs14-develUpgrade nodejs14Upgrade nodejs10Upgrade npm12Upgrade nodejs12-develUpgrade npm10Upgrade nodejs8-develUpgrade nodejs10-develUpgrade nodejs14-docsUpgrade nodejs8Upgrade nodejs12Upgrade nodejs12-docsUpgrade npm8Upgrade nodejs8-docsUpgrade nodejs10-docs | Feb 28, 2021 | Feb 26, 2021 |
| Ubuntu | — | Upgrade nodejsUpgrade libnode-devUpgrade nodejs-dev (Ubuntu Pro)Upgrade libnode64Upgrade nodejs (Ubuntu Pro) | Oct 6, 2023 | Mar 3, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 3, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub