Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-nodemonUpgrade npm | May 4, 2022 | Aug 16, 2021 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Aug 16, 2021 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs | Sep 22, 2021 | Aug 16, 2021 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Oct 15, 2021 |
| Freebsd | — | Upgrade mariadb104-serverUpgrade mysql-connector-javaUpgrade mysql57-serverUpgrade mysql80-serverUpgrade node14Upgrade nodeUpgrade mysql80-clientUpgrade mariadb105-serverUpgrade mariadb103-server | Nov 4, 2022 | Oct 17, 2021 |
| Gentoo Linux | — | Upgrade net-dns/c-ares.Upgrade net-libs/nodejs. | Jan 8, 2024 | Aug 16, 2021 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-14 to version 14.17.6-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-16 to version 16.11.1-11.4.39.0.1.107.2 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.22.5-11.4.38.0.1.101.2 on Solaris 11.4Upgrade runtime/nodejs to version 14.17.6-11.4.38.0.1.101.2 on Solaris 11.4 | Nov 17, 2021 | Aug 16, 2021 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs | Sep 23, 2021 | Aug 11, 2021 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-docsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-debuginfo | Sep 22, 2021 | Aug 16, 2021 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejsUpgrade npm | May 5, 2022 | Aug 16, 2021 |
| Suse | — | Upgrade nodejs12-develUpgrade nodejs14Upgrade nodejs10Upgrade nodejs12-docsUpgrade npm14Upgrade nodejs14-develUpgrade nodejs12Upgrade nodejs10-docsUpgrade npm12Upgrade nodejs14-docsUpgrade nodejs10-develUpgrade npm10 | Aug 31, 2021 | Aug 16, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 16, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub