Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-docsUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-full-i18n | May 4, 2022 | Aug 16, 2021 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Mar 26, 2024 | Aug 16, 2021 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemon | Sep 22, 2021 | Aug 16, 2021 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 15, 2021 |
| Freebsd | — | Upgrade mysql80-serverUpgrade mysql57-serverUpgrade mariadb104-serverUpgrade mysql-connector-javaUpgrade node14Upgrade mariadb103-serverUpgrade nodeUpgrade mysql80-clientUpgrade mariadb105-server | Nov 4, 2022 | Oct 17, 2021 |
| Gentoo Linux | — | Upgrade net-dns/c-ares.Upgrade net-libs/nodejs. | Jan 8, 2024 | Aug 16, 2021 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-14 to version 14.17.6-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.22.5-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs to version 14.17.6-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-16 to version 16.11.1-11.4.39.0.1.107.2 on Solaris 11.4 | Nov 17, 2021 | Aug 16, 2021 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade npmUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-packaging | Sep 23, 2021 | Aug 11, 2021 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-docs | Sep 22, 2021 | Aug 16, 2021 |
| Rocky_linux | — | Upgrade npmUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-devel | May 5, 2022 | Aug 16, 2021 |
| Suse | — | Upgrade nodejs12-docsUpgrade npm14Upgrade nodejs10-docsUpgrade nodejs12Upgrade nodejs14-develUpgrade nodejs12-develUpgrade nodejs14Upgrade nodejs10Upgrade npm10Upgrade nodejs10-develUpgrade nodejs14-docsUpgrade npm12 | Aug 31, 2021 | Aug 16, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 16, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub