Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libuv-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade libuv | May 4, 2022 | Jul 12, 2021 |
| Alpine Linux | — | Upgrade nodejs | Oct 1, 2024 | Jul 12, 2021 |
| Amazon Linux Ami 2 | — | Upgrade libuvUpgrade libuv-develUpgrade libuv-staticUpgrade libuv-debuginfo | Jan 10, 2024 | Jul 12, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 12, 2021 |
| Centos_linux | — | Upgrade npmUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade libuv-debuginfoUpgrade nodejs-docsUpgrade libuvUpgrade nodejs-full-i18nUpgrade libuv-debugsourceUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-debuginfo | Aug 12, 2021 | Jul 12, 2021 |
| Debian | — | Upgrade libuv1 | Jul 8, 2021 | Jul 8, 2021 |
| Freebsd | — | Upgrade node14Upgrade node | Nov 4, 2022 | Sep 21, 2021 |
| Gentoo Linux | — | Upgrade net-libs/nodejs.Upgrade dev-libs/libuv. | Jan 17, 2024 | Jul 12, 2021 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-14 to version 14.17.6-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.22.5-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs to version 14.17.6-11.4.38.0.1.101.2 on Solaris 11.4 | Nov 17, 2021 | Jul 12, 2021 |
| Oracle_linux | — | Upgrade nodejsUpgrade npmUpgrade libuvUpgrade libuv-develUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemon | Aug 12, 2021 | Jul 1, 2021 |
| Redhat_linux | — | Upgrade libuvUpgrade nodejsUpgrade libuv-debuginfoUpgrade npmUpgrade nodejs-develUpgrade nodejs-packagingUpgrade libuv-debugsourceUpgrade libuv-develUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-debuginfo | Aug 12, 2021 | Jul 12, 2021 |
| Rocky_linux | — | Upgrade libuvUpgrade libuv-develUpgrade libuv-debugsourceUpgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade libuv-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-debuginfo | Mar 12, 2024 | Jul 12, 2021 |
| Suse | — | Upgrade nodejs10Upgrade npm12Upgrade nodejs14Upgrade nodejs12-docsUpgrade nodejs14-docsUpgrade nodejs10-docsUpgrade npm10Upgrade npm14Upgrade nodejs14-develUpgrade nodejs10-develUpgrade nodejs12-develUpgrade nodejs12 | Jul 15, 2021 | Jul 7, 2021 |
| Ubuntu | — | Upgrade libuv1 | Jul 8, 2021 | Jul 7, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub