Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade libuv-develUpgrade libuv | May 4, 2022 | Jul 12, 2021 |
| Alpine Linux | — | Upgrade nodejs | Oct 1, 2024 | Jul 12, 2021 |
| Amazon Linux Ami 2 | — | Upgrade libuv-debuginfoUpgrade libuv-develUpgrade libuv-staticUpgrade libuv | Jan 10, 2024 | Jul 12, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 12, 2021 |
| Centos_linux | — | Upgrade nodejsUpgrade libuv-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade libuvUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade libuv-debugsourceUpgrade nodejs-packaging | Aug 12, 2021 | Jul 12, 2021 |
| Debian | — | Upgrade libuv1 | Jul 8, 2021 | Jul 8, 2021 |
| Freebsd | — | Upgrade nodeUpgrade node14 | Nov 4, 2022 | Sep 21, 2021 |
| Gentoo Linux | — | Upgrade net-libs/nodejs.Upgrade dev-libs/libuv. | Jan 17, 2024 | Jul 12, 2021 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-12 to version 12.22.5-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs to version 14.17.6-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-14 to version 14.17.6-11.4.38.0.1.101.2 on Solaris 11.4 | Nov 17, 2021 | Jul 12, 2021 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade libuv-develUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-develUpgrade libuvUpgrade nodejsUpgrade npm | Aug 12, 2021 | Jul 1, 2021 |
| Redhat_linux | — | Upgrade libuvUpgrade npmUpgrade nodejsUpgrade libuv-debuginfoUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade libuv-debugsourceUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade libuv-develUpgrade nodejs-nodemonUpgrade nodejs-docs | Aug 12, 2021 | Jul 12, 2021 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade libuv-debugsourceUpgrade libuv-develUpgrade nodejsUpgrade libuvUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade libuv-debuginfo | Mar 12, 2024 | Jul 12, 2021 |
| Suse | — | Upgrade nodejs12-docsUpgrade npm12Upgrade nodejs14-docsUpgrade nodejs14Upgrade nodejs10Upgrade nodejs12Upgrade npm10Upgrade npm14Upgrade nodejs12-develUpgrade nodejs14-develUpgrade nodejs10-docsUpgrade nodejs10-devel | Jul 15, 2021 | Jul 7, 2021 |
| Ubuntu | — | Upgrade libuv1 | Jul 8, 2021 | Jul 7, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub