Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-libuvalma-upgrade-libuv-develalma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packaging | May 4, 2022 | Jul 12, 2021 | |
| Alpine Linux | alpine-linux-upgrade-nodejs | Oct 1, 2024 | Jul 12, 2021 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-libuvamazon-linux-ami-2-upgrade-libuv-debuginfoamazon-linux-ami-2-upgrade-libuv-develamazon-linux-ami-2-upgrade-libuv-static | Jan 10, 2024 | Jul 12, 2021 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jul 12, 2021 | |
| Centos_linux | — | centos-upgrade-libuvcentos-upgrade-libuv-debuginfocentos-upgrade-libuv-debugsourcecentos-upgrade-nodejscentos-upgrade-nodejs-debuginfocentos-upgrade-nodejs-debugsourcecentos-upgrade-nodejs-develcentos-upgrade-nodejs-docscentos-upgrade-nodejs-full-i18ncentos-upgrade-nodejs-nodemoncentos-upgrade-nodejs-packagingcentos-upgrade-npm | Aug 12, 2021 | Jul 12, 2021 |
| Debian | debian-upgrade-libuv1 | Jul 8, 2021 | Jul 8, 2021 | |
| Freebsd | freebsd-upgrade-package-node14freebsd-upgrade-package-node | Nov 4, 2022 | Sep 21, 2021 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-libs-libuvgentoo-linux-upgrade-net-libs-nodejs | Jan 17, 2024 | Jul 12, 2021 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-runtime-nodejs-14-17-6-11-4-38-0-1-101-2oracle-solaris-11-4-upgrade-runtime-nodejs-nodejs-12-12-22-5-11-4-38-0-1-101-2oracle-solaris-11-4-upgrade-runtime-nodejs-nodejs-14-14-17-6-11-4-38-0-1-101-2 | Nov 17, 2021 | Jul 12, 2021 | |
| Oracle_linux | — | oracle-linux-upgrade-libuvoracle-linux-upgrade-libuv-develoracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-npm | Aug 12, 2021 | Jul 1, 2021 |
| Redhat_linux | redhat-upgrade-libuvredhat-upgrade-libuv-debuginforedhat-upgrade-libuv-debugsourceredhat-upgrade-libuv-develredhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-npm | Aug 12, 2021 | Jul 12, 2021 | |
| Rocky_linux | rocky-upgrade-libuvrocky-upgrade-libuv-debuginforocky-upgrade-libuv-debugsourcerocky-upgrade-libuv-develrocky-upgrade-nodejsrocky-upgrade-nodejs-debuginforocky-upgrade-nodejs-debugsourcerocky-upgrade-nodejs-develrocky-upgrade-nodejs-full-i18nrocky-upgrade-npm | Mar 12, 2024 | Jul 12, 2021 | |
| Suse | — | suse-upgrade-nodejs10suse-upgrade-nodejs10-develsuse-upgrade-nodejs10-docssuse-upgrade-nodejs12suse-upgrade-nodejs12-develsuse-upgrade-nodejs12-docssuse-upgrade-nodejs14suse-upgrade-nodejs14-develsuse-upgrade-nodejs14-docssuse-upgrade-npm10suse-upgrade-npm12suse-upgrade-npm14 | Jul 15, 2021 | Jul 7, 2021 |
| Ubuntu | ubuntu-upgrade-libuv1 | Jul 8, 2021 | Jul 7, 2021 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jul 12, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub